QuestionQ1
Security Test TechniquesWhich of the following is an example of reconciliation testing?
- A Reviewing and re-approving employee access to sensitive systems, confirming that users still require the access based on their current job responsibilities
- B Verifying that access rights of all active user accounts in the company’s HR system match the records in the identity management database
- C Verifying that access to privileged accounts is reviewed annually to ensure that only authorized personnel retain such access
- D Checking regularly that user accounts with access to customer data still need this access, ensuring that unneeded privileges are removed
QuestionQ2
Security Test TechniquesWhich of the following is an example of firewall testing?
- A Ensuring that when queried, the system returns data masked or replaced with random characters, verifying that sensitive data is protected from unauthorized users
- B Using a tool to scan the network and identify open ports, ensuring that only the necessary ports are open and that all other ports are properly blocked
- C Verifying that the access of the system to the right roles is restricted, services are open only when needed, and application updates are properly monitored
- D Using “brute force” or “dictionary” attacks to attempt to get plain data from obfuscated data, and performing reverse-engineering of byte code
Community Discussion
QuestionQ3
Adjusting Security Testing to the Organizational ContextWhich of the following accurately characterizes the relationship between information sensitivity and security testing?
- A A popular e-commerce website requires rigorous stress testing, whereas a small personal blog may only need basic testing of login security mechanisms.
- B A financial application storing customer data requires encryption validation, whereas a public news app may require basic security measures.
- C A public forum website requires high-level integrity testing whereas an online banking platform primarily needs availability testing to ensure users can log in anytime.
- D A hospital’s health record system requires minimal security testing since doctors primarily need availability, while a messaging app needs extensive testing to protect conversations.
Community Discussion
QuestionQ4
Security Test TechniquesA tester used rainbow tables in a brute-force attack to uncover user passwords. What type of testing is this?
- A Testing the authentication mechanism
- B Testing the accounting mechanism
- C Testing the authorization mechanism
- D Testing the system hardening mechanism
Community Discussion
QuestionQ5
Security ParadigmsA company enforces a policy in which employees receive access only to the specific systems and data required for their roles, so that no user has more access than necessary. The company also requires employees to use their password and a time-based one-time passcode delivered to their mobile device or an authenticator app to access internal systems. To protect against possible cyber threats, every employee’s laptop, mobile device, and tablet has security software that continuously watches for suspicious activity, such as malware or unauthorized access attempts.
Which Zero Trust concept is MISSING from this scenario?
- A Security monitoring of device endpoints
- B Micro-segmentation
- C Multi-factor authentication
- D “Least privilege access” principle
Community Discussion
That's the end of the preview
It's free
100% of the questions are free for all users.
No strings attached.
Community Discussion