CERTIFIED-IN-CYBERSECURITY Practice Questions

In the context of risk management, which information does ALE outline?

Which of these is NOT a best practice in access management? ()

A poster reminding the best password management practices is an example of which type of learning activity?

Which of these is NOT a feature of a SIEM (Security Information and Event Management)?

Which of these types of credentials is NOT used in multi-factor authentication?

Which of these cloud deployment models is a combination of public and private cloud storage?

Which of these addresses is commonly reserved specifically for broadcasting?

Which of these statements is TRUE about cybersquatting? ()

Which of these types of malware self-replicates without the need for human intervention?

What does the term LAN refer to?

A high-level executive of an organization receives a malicious email that tries to trick him. Which attack is the perpetrator using?

As an (ISC)?member, you are expected to perform with due care. What does 'due care' specifically mean?

The name, age, location and job title of a person are all examples of:

Which of these terms refers to threats with unusually high technical and operational sophistication, spanning months or even years?

Which of these is NOT a best practice in access management?

Which of these CANNOT be a corrective security control?

Which of these is NOT a characteristic of an MSP implementation?

The primary objective of a Business Continuity Plan (BCP) is:

A backup that captures the changes made since the latest full backup is an example of:

Which of these properties is NOT guaranteed by a Message Authentication Code (MAC)? ()

When analyzing risks, which of these activities is required? ()

Which of these is NOT a security principle?

Which of these statements about the security implications of IPv6 is NOT true? ()

Which department in a company is NOT typically involved in a Disaster Recovery Plan (DRP)?

Requiring a specific user role to access resources is an example of which access control model:

On an Incident Response team, which role acts as the team's main link to Senior Management?

A security consultant hired to design the security policies for the PHI within an organization will be primarily handling:

Acting ethically is mandatory for (ISC)?members. Which of these is NOT considered unethical?

Which of these documents is MORE directly related to what can be done with a system or with its information?

Which of these terms refers to a collection of fixes?

In an incident response process, which phase uses indicators of compromise and log analysis as part of a review of events?

What does redundancy mean in the context of cybersecurity?

At which of the OSI layers do TCP and UDP work?

During the investigation of an incident, which security policies are more likely to cause difficulties?

Which of these access control models is commonly used in the military?

Which type of attack attempts to mislead the user into exposing personal information by sending fraudulent emails?

Which type of security control does NOT include CCTV cameras?

Which of the following is an implementation of an administrative control? ()

When looking for cybersecurity insurance, which of these is the MOST IMPORTANT objective?

Suppose that an organization wants to implement measures to strengthen its detective access controls. Which one of these tools should they implement?

Which of these types of documents is usually THE LEAST formal?

Which of these devices has the PRIMARY objective of determining the most efficient path for the traffic to flow across the network

Which one of these tools is MOST likely to detect an XSS vulnerability?

While performing background checks on new employees, which of these can NEVER be an attribute for discrimination?

Which kind of document outlines the procedures ensuring that vital company systems keep running during business-disrupting events?

Which method is COMMONLY used to map live hosts in the network?

What is the most important difference between Mandatory Access Control (MAC) and Discretionary Access Control (DAC)?

Which of these technologies is the LEAST effective means of preventing shared accounts?

Which of these is NOT a typical component of a comprehensive Business Continuity Plan (BCP)?

Which of these is an attack whose PRIMARY goal is to gain access to a target system through falsified identity?