EXAM OBJECTIVES COVERED IN THIS CHAPTER:

• 2.1 Given a scenario, apply security solutions for infrastructure management.
  • Cloud vs. on-premises
  • Asset management
  • Segmentation
  • Network architecture
  • Change management
  • Virtualization
  • Containerization
  • Identity and access management
  • Cloud access security broker (CASB)
  • Honeypot
  • Monitoring and logging
  • Encryption
  • Certificate management
  • Active defense
• 2.2 Explain software assurance best practices.
  • Platforms
  • Software development lifecycle (SDLC) integration
  • DevSecOps
  • Software assessment methods
  • Secure coding best practices
  • Static analysis tools
  • Dynamic analysis tools
  • Formal methods for verification of critical software
  • Service-oriented architecture
• 2.3 Explain hardware assurance best practices.
  • Hardware root of trust
  • eFuse
  • Unified Extensible Firmware Interface (UEFI)
  • Trusted Foundry
  • Secure processing
  • Anti-tamper
  • Self-encrypting drive
  • Trusted firmware updates
  • Measured boot and attestation
  • Bus encryption

1. What purpose does a honeypot system serve when placed on a network as shown in the following diagram?

   

   1. It prevents attackers from targeting production servers.
   2. It provides information about the techniques attackers are using.
   3. It slows down attackers like sticky honey.
   4. It provides real-time input to IDSs and IPSs.
2. A tarpit, or a system that looks vulnerable but actually is intended to slow down attackers, is an example of what type of technique?
   1. A passive defense
   2. A sticky defense
   3. An active defense
   4. A reaction-based defense
3. As part of a government acquisitions program for the U.S. Department of Defense, Sean is required to ensure that the chips and other hardware level components used in the switches, routers, and servers that he purchases do not include malware or other potential attack vectors. What type of supplier should Sean seek out?
   1. A TPM
   2. An OEM provider
   3. A trusted foundry
   4. A gray-market provider
4. Susan needs to test thousands of submitted binaries. She needs to ensure that the applications do not contain malicious code. What technique is best suited to this need?
   1. Sandboxing
   2. Implementing a honeypot
   3. Decompiling and analyzing the application code
   4. Fagan testing
5. Manesh downloads a new security tool and checks its MD5. What does she know about the software she downloaded if she receives the following message:

   root@demo:~# md5sum -c demo.md5
   demo.txt: FAILED
   md5sum: WARNING: 1 computed checksum did NOT match 

   1. The file has been corrupted.
   2. Attackers have modified the file.
   3. The files do not match.
   4. The test failed and provided no answer.
6. Tracy is designing a cloud infrastructure for her company and wants to generate and store encryption keys in a secure way. What type of technology should she look for as part of her infrastructure as a service vendor's portfolio?
   1. TPM
   2. HSM
   3. UEFI
   4. VPC
7. Aziz needs to provide SSH access to systems behind his datacenter firewall. If Aziz's organization uses the system architecture shown here, what is the system at point A called?

   

   1. A firewall-hopper
   2. An isolated system
   3. A moat-protected host
   4. A jump box
8. Charles wants to provide additional security for his web application, which currently stores passwords in plaintext in a database. Which of the following options will best prevent theft of the database resulting in exposed passwords?
   1. Encrypt the database of plaintext passwords
   2. Use MD5 and a salt
   3. Use SHA-1 and a salt
   4. Use bcrypt
9. What type of protected boot process is illustrated in the following diagram?

   

   1. Measured boot
   2. TPM
   3. Remote attestation
   4. Signed BIOS
10. An access control system that relies on the operating system to constrain the ability of a subject to perform operations is an example of what type of access control system?
    1. A discretionary access control system
    2. A role-based access control system
    3. A mandatory access control system
    4. A level-based access control system
11. During his analysis of a malware sample, Sahib reviews the malware files and binaries without running them. What type of analysis is this?
    1. Automated analysis
    2. Dynamic analysis
    3. Static analysis
    4. Heuristic analysis
12. Carol wants to analyze a malware sample that she has discovered. She wants to run the sample safely while capturing information about its behavior and impact on the system it infects. What type of tool should she use?
    1. A static code analysis tool
    2. A dynamic analysis sandbox tool
    3. A Fagan sandbox
    4. A decompiler running on an isolated VM

    Use the following scenario for questions 13–15.

    Mike is in charge of the software testing process for his company. They perform a complete set of tests for each product throughout its lifespan. Use your knowledge of software assessment methods to answer the following questions.

13. A new web application has been written by the development team in Mike's company. They used an Agile process and have built a tool that fits all of the user stories that the participants from the division that asked for the application outlined. If they want to ensure that the functionality is appropriate for all users in the division, what type of testing should Mike perform?
    1. Stress testing
    2. Regression testing
    3. Static testing
    4. User acceptance testing
14. Mike's development team wants to expand the use of the software to the whole company, but they are concerned about its performance. What type of testing should they conduct to ensure that the software will not fail under load?
    1. Stress testing
    2. Regression testing
    3. Static testing
    4. User acceptance testing
15. Two years after deployment, Mike's team is ready to roll out a major upgrade to their web application. They have pulled code from the repository that it was checked into but are worried that old bugs may have been reintroduced because they restored additional functionality based on older code that had been removed in a release a year ago. What type of testing does Mike's team need to perform?
    1. Stress testing
    2. Regression testing
    3. Static testing
    4. User acceptance testing
16. Susan is reviewing files on a Windows workstation and believes that cmd.exe has been replaced with a malware package. Which of the following is the best way to validate her theory?
    1. Submit cmd.exe to VirusTotal.
    2. Compare the hash of cmd.exe to a known good version.
    3. Check the file using the National Software Reference Library.
    4. Run cmd.exe to make sure its behavior is normal.
17. As part of her malware analysis process, Caitlyn diagrams the high-level functions and processes that the malware uses to accomplish its goals. What is this process known as?
    1. Static analysis
    2. Composition
    3. Dynamic analysis
    4. Decomposition
18. As a U.S. government employee, Michael is required to ensure that the network devices that he procures have a verified chain of custody for every chip and component that goes into them. What is this program known as?
    1. Gray-market procurement
    2. Trusted foundry
    3. White-market procurement
    4. Chain of procurement
19. Padma is evaluating the security of an application developed within her organization. She would like to assess the application's security by supplying it with invalid inputs. What technique is Padma planning to use?
    1. Fault injection
    2. Stress testing
    3. Mutation testing
    4. Fuzz testing
20. Nishi is deploying a new application that will process sensitive health information about her organization's clients. In order to protect this information, the organization is building a new network that does not share any hardware or logical access credentials with the organization's existing network. What approach is Nishi adopting?
    1. Network interconnection
    2. Network segmentation
    3. Virtual LAN (VLAN) isolation
    4. Virtual private network (VPN)
21. Bobbi is deploying a single system that will be used to manage a very sensitive industrial control process. This system will operate in a standalone fashion and not have any connection to other networks. What strategy is Bobbi deploying to protect this SCADA system?
    1. Network segmentation
    2. VLAN isolation
    3. Airgapping
    4. Logical isolation
22. Which software development life cycle model is illustrated in the image?

    

    1. Waterfall
    2. Spiral
    3. Agile
    4. RAD
23. Geoff has been asked to identify a technical solution that will reduce the risk of captured or stolen passwords being used to allow access to his organization's systems. Which of the following technologies should he recommend?
    1. Captive portals
    2. Multifactor authentication
    3. VPNs
    4. OAuth
24. The company that Amanda works for is making significant investments in infrastructure as a service hosting to replace their traditional datacenter. Members of her organization's management have expressed concerns about data remanence when Amanda's team moves from one virtual host to another in their cloud service provider's environment. What should she instruct her team to do to avoid this concern?
    1. Zero-wipe drives before moving systems.
    2. Use full-disk encryption.
    3. Use data masking.
    4. Span multiple virtual disks to fragment data.
25. Huan is hiring a third-party consultant who will have remote access to the organization's datacenter, but he would like to approve that access each time it occurs. Which one of the following solutions would meet Huan's needs in a practical manner?
    1. Huan should keep the consultant's password himself and provide it to the consultant when needed, and then immediately change the password after each use.
    2. Huan should provide the consultant with the password but configure his own device to approve logins via multifactor authentication.
    3. Huan should provide the consultant with the password but advise the consultant that she must advise him before using the account and then audit those attempts against access logs.
    4. Huan should create a new account for the consultant each time she needs to access the datacenter.
26. Ian is reviewing the security architecture shown here. This architecture is designed to connect his local datacenter with an IaaS service provider that his company is using to provide overflow services. What component can be used at the points marked by the question marks (?s) to provide a secure encrypted network connection?

    

    1. Firewall
    2. VPN
    3. IPS
    4. DLP
27. Which one of the following technologies is not typically used to implement network segmentation?
    1. Host firewall
    2. Network firewall
    3. VLAN tagging
    4. Routers and switches
28. Which one of the following approaches is an example of a formal code review process?
    1. Pair programming
    2. Over-the-shoulder
    3. Fagan inspection
    4. Pass-around code review
29. The Open Web Application Security Project (OWASP) maintains an application called Orizon. This application reviews Java classes and identifies potential security flaws. What type of tool is Orizon?
    1. Fuzzer
    2. Static code analyzer
    3. Web application assessor
    4. Fault injector
30. Barney's organization mandates fuzz testing for all applications before deploying them into production. Which one of the following issues is this testing methodology most likely to detect?
    1. Incorrect firewall rules
    2. Unvalidated input
    3. Missing operating system patches
    4. Unencrypted data transmission
31. Kobe wants to provide access to a jump box in a secured network. What technology should he deploy to allow a secure connection to the system through untrusted intermediary networks?
    1. VPC
    2. An air gap
    3. A VPN
    4. Physical segmentation
32. Mia would like to ensure that her organization's cybersecurity team reviews the architecture of a new ERP application that is under development. During which SDLC phase should Mia expect the security architecture to be completed?
    1. Analysis and Requirements Definition
    2. Design
    3. Development
    4. Testing and Integration
33. Which one of the following security activities is not normally a component of the Operations and Maintenance phase of the SDLC?
    1. Vulnerability scans
    2. Disposition
    3. Patching
    4. Regression testing
34. Which hardware device is used on endpoint devices to store RSA encryption keys specific to that device to allow hardware authentication?
    1. A SSD
    2. A hard drive
    3. A MFA token
    4. A TPM
35. Which one of the following testing techniques is typically the final testing done before code is released to production?
    1. Unit testing
    2. Integration testing
    3. User acceptance testing
    4. Security testing

    Use the following scenario for questions 36–38.

    Olivia has been put in charge of performing code reviews for her organization and needs to determine which code analysis models make the most sense based on specific needs her organization has. Use your knowledge of code analysis techniques to answer the following questions.

36. Olivia's security team has identified potential malicious code that has been uploaded to a webserver. If she wants to review the code without running it, what technique should she use?
    1. Dynamic analysis
    2. Fagan analysis
    3. Regression analysis
    4. Static analysis
37. Olivia's next task is to test the code for a new mobile application. She needs to test it by executing the code and intends to provide the application with input based on testing scenarios created by the development team as part of their design work. What type of testing will Olivia conduct?
    1. Dynamic analysis
    2. Fagan analysis
    3. Regression analysis
    4. Static analysis
38. After completing the first round of tests for her organization's mobile application, Olivia has discovered indications that the application may not handle unexpected data well. What type of testing should she conduct if she wants to test it using an automated tool that will check for this issue?
    1. Fault injection
    2. Fagan testing
    3. Fuzzing
    4. Failure injection
39. Which one of the following characters would not signal a potential security issue during the validation of user input to a web application?
    1. <
    2. `
    3. >
    4. $
40. The Open Web Application Security Project (OWASP) maintains a listing of the most important web application security controls. Which one of these items is least likely to appear on that list?
    1. Implement identity and authentication controls
    2. Implement appropriate access controls
    3. Obscure web interface locations
    4. Leverage security frameworks and libraries
41. Kyle is developing a web application that uses a database backend. He is concerned about the possibility of an SQL injection attack against his application and is consulting the OWASP proactive security controls list to identify appropriate controls. Which one of the following OWASP controls is least likely to prevent a SQL injection attack?
    1. Parameterize queries
    2. Validate all input
    3. Encode data
    4. Implement logging and intrusion detection
42. Jill's organization has adopted an asset management tool. If she wants to identify systems on the network based on a unique identifier per machine that will not normally change over time, which of the following options can she use for network-based discovery?
    1. IP address
    2. Hostname
    3. MAC address
    4. None of the above
43. Barcodes and RFID tags are both frequently used for what asset management practice?
    1. Asset disposition
    2. Asset tagging
    3. Asset acquisition
    4. Asset lifespan estimation
44. What type of secure boot process is shown in the following image?

    

    1. Remote attestation
    2. Measured boot
    3. Logged loader
    4. UEFI
45. Ian has been asked to deploy a secure wireless network in parallel with a public wireless network inside his organization's buildings. What type of segmentation should he implement to do so without adding additional costs and complexity?
    1. SSID segmentation
    2. Logical segmentation
    3. Physical segmentation
    4. WPA segmentation
46. Barbara has segmented her virtualized servers using VMware to ensure that the networks remain secure and isolated. What type of attack could defeat her security design?
    1. VLAN hopping
    2. 802.1q trunking vulnerabilities
    3. Compromise of the underlying VMware host
    4. BGP route spoofing
47. What major issue would Charles face if he relied on hashing malware packages to identify malware packages?
    1. Hashing can be spoofed.
    2. Collisions can result in false positives.
    3. Hashing cannot identify unknown malware.
    4. Hashing relies on unencrypted malware samples.
48. Noriko wants to ensure that attackers cannot access his organization's building automation control network. Which of the following segmentation options provides the strongest level of assurance that this will not happen?
    1. Air gap
    2. VLANs
    3. Network firewalls
    4. Host firewalls
49. What type of network device is most commonly used to connect two or more networks to forward traffic between them?
    1. A switch
    2. A firewall
    3. A router
    4. An IPS

    Use the following scenario for questions 50–53.

    Angela is a security practitioner at a mid-sized company that recently experienced a serious breach due to a successful phishing attack. The company has committed to changing their security practices across the organization and has assigned Angela to determine the best strategy to make major changes that will have a significant impact right away.

50. Angela's company has relied on passwords as their authentication factor for years. The current organizational standard is to require an eight-character, complex password, and to require a password change every 12 months. What recommendation should Angela make to significantly decrease the likelihood of a similar phishing attack and breach in the future?
    1. Increase the password length.
    2. Shorten the password lifespan.
    3. Deploy multifactor authentication.
    4. Add a PIN to all logins.
51. Angela has decided to roll out a multifactor authentication system. What are the two most common factors used in MFA systems?
    1. Location and knowledge
    2. Knowledge and possession
    3. Knowledge and biometric
    4. Knowledge and location
52. As part of the investigation after the breach, Angela's team noticed that some staff were using organizational resources after hours when they weren't supposed to be logged in. What type of authentication model could she deploy to use information about an employee's role and work hours to manage when they can be logged in?
    1. Location factors
    2. Biometric factors
    3. Context based authentication
    4. Multifactor authentication
53. Angela's multifactor deployment includes the ability to use text (SMS) messages to send the second factor for authentication. What issues should she point to?
    1. VoIP hacks and SIM swapping
    2. SMS messages are logged on the recipient's phones
    3. PIN hacks and SIM swapping
    4. VoIP hacks and PIN hacks
54. Keith needs to manage digital keys, and he wants to implement a hardware security module in his organization. What U.S. government standard are hardware security modules often certified against?
    1. PCI-DSS
    2. HSM-2015
    3. FIPS 140-2
    4. CA-Check
55. What purpose does the OpenFlow protocol serve in software-defined networks?
    1. It captures flow logs from devices.
    2. It allows software-defined network controllers to push changes to devices to manage the network.
    3. It sends flow logs to flow controllers.
    4. It allows devices to push changes to SDN controllers to manage the network.
56. What type of access control system relies on the operating system to control the ability of subjects to perform actions on objects through a set of policies controlled by a policy administrator?
    1. RBAC
    2. MAC
    3. DAC
    4. ABAC
57. What term is used to describe an isolated pool of cloud resources for a specific organization or user allocated inside of a public cloud environment?
    1. VPN
    2. VPC
    3. CDA
    4. CCA
58. Rick's security research company wants to gather data about current attacks and sets up a number of intentionally vulnerable systems that allow his team to log and analyze exploits and attack tools. What type of environment has Rick set up?
    1. A tarpit
    2. A honeypot
    3. A honeynet
    4. A blackhole
59. Kalea wants to prevent DoS attacks against her serverless application from driving up her costs when using a cloud service. What technique is not an appropriate solution for her need?
    1. Horizontal scaling
    2. API keys
    3. Setting a cap on API invocations for a given timeframe
    4. Using timeouts
60. What is the purpose of change management in an organization?
    1. Ensuring changes are scheduled
    2. Ensuring changes are documented
    3. Ensuring that only approved changes are made
    4. All of the above
61. What is the key difference between virtualization and containerization?
    1. Virtualization gives operating systems direct access to the hardware, whereas containerization does not allow applications to directly access the hardware.
    2. Virtualization lets you run multiple operating systems on a single physical system, whereas containerization lets you run multiple applications on the same system.
    3. Virtualization is necessary for containerization, but containerization is not necessary for virtualization.
    4. There is not a key difference; they are elements of the same technology.
62. Which software development methodology is illustrated in the diagram?

    

    1. Spiral
    2. RAD
    3. Agile
    4. Waterfall
63. What advantage does a virtual desktop infrastructure have when addressing data theft?
    1. No data is stored locally on the endpoint device
    2. Built-in DLP
    3. All data is encrypted at rest
    4. All data is stored locally on the endpoint device
64. Brandon is designing the hosting environment for containerized applications. Application group A has personally identifiable information, Application group B has health information with different legal requirements for handling, and Application group C has business sensitive data handling requirements. What is the most secure design for his container orchestration environment given the information he has?
    1. Run a single, highly secured container host with encryption for data at rest.
    2. Run a container host for each application group and secure them based on the data they contain.
    3. Run a container host for groups A and B, and a lower-security container host for group C.
    4. Run a container host for groups A and C, and a health information–specific container host for group B due to the health information it contains.
65. Local and domain administrator accounts, root accounts, and service accounts are all examples of what type of account?
    1. Monitored accounts
    2. Privileged accounts
    3. Root accounts
    4. Unprivileged accounts
66. Ned has discovered a key logger plugged into one of his workstations, and he believes that an attacker may have acquired usernames and passwords for all of the users of a shared workstation. Since he does not know how long the keylogger was in use or if it was used on multiple workstations, what is his best security option to prevent this and similar attacks from causing issues in the future?
    1. Multifactor authentication
    2. Password complexity rules
    3. Password lifespan rules
    4. Prevent the use of USB devices
67. Facebook Connect, CAS, Shibboleth, and ADFS are all examples of what type of technology?
    1. Kerberos implementations
    2. Single sign-on implementations
    3. Federation technologies
    4. OAuth providers
68. Which of the following is not a common identity protocol for federation?
    1. SAML
    2. OpenID
    3. OAuth
    4. Kerberos
69. Mei is designing her organization's datacenter network and wants to establish a secure zone and a DMZ. If Mei wants to ensure that user accounts and traffic that manage systems in the DMZ are easily auditable, and that all access can be logged while helping prevent negative impacts from compromised or infected workstations, which of the following solutions is Mei's best design option?
    1. Administrative virtual machines run on administrator workstations
    2. A jump host
    3. A bastion host
    4. SSH or RDP from administrative workstations
70. The identity management system used by Greg's new employer provides rights based on his job as a system administrator. What type of access control system is this?
    1. RBAC
    2. MAC
    3. DAC
    4. ABAC
71. During a periodic audit of account privileges, Rhonda reviews the account rights in an Active Directory domain for every administrative user and removes any rights to directories or systems that should no longer be available to the administrative users. What type of review is this?
    1. Manual review
    2. IAM assessment
    3. Mandatory audit review
    4. Discretional audit review
72. Naomi wants to enforce her organization's security policies on cloud service users. What technology is best suited to this?
    1. OAuth
    2. CASB
    3. OpenID
    4. DMARC
73. Lucca wants to ensure that his Windows logs capture events for one month. What setting should he change in the settings to ensure this?

    

    1. Increase the size of the log file to 40480.
    2. Leave the log file as is.
    3. Change the setting to archive the log when full.
    4. Clear the log to start clean.
74. Elliott wants to encrypt data sent between his servers. What protocol is most commonly used for secure web communications over a network?
    1. TLS
    2. SSL
    3. IPSec
    4. PPTP
75. What occurs when a website's certificate expires?
    1. Web browsers will report an expired certificate to users.
    2. The website will no longer be accessible.
    3. The certificate will be revoked.
    4. All of the above.
76. What term is used to describe defenses that obfuscate the attack surface of an organization by deploying decoys and attractive targets to slow down or distract an attacker?
    1. An active defense
    2. A honeyjar
    3. A bear trap
    4. An interactive defense
77. The OWASP mobile application security checklist's cryptography requirements include a requirement that the application uses “proven implementations of cryptographic primitives.” What does this requirement mean, and why is it in the checklist?
    1. Only use basic cryptographic techniques to ensure that developers can understand them
    2. Only use proven versions of cryptographic algorithms so that they will be secure
    3. Only use in-house developed and tested cryptographic algorithms to avoid known vulnerabilities
    4. Only use open source cryptographic techniques to ensure that their source code can be reviewed
78. Claire knows that a web application that her organization needs to have in production has vulnerabilities due to a recent scan using a web application security scanner. What is her best protection option if she knows that the vulnerability is a known SQL injection flaw?
    1. A firewall
    2. An IDS
    3. A WAF
    4. DLP

    Use the following scenario to answer questions 79–81.

    Donna has been assigned as the security lead for a DevSecOps team building a new web application. As part of the effort, she has to oversee the security practices that the team will use to protect the application. Use your knowledge of secure coding practices to help Donna guide her team through this process.

79. A member of Donna's team recommends building a blacklist to avoid dangerous characters like ‘and <script> tags. How could attackers bypass a blacklist that individually identified those characters?
    1. They can use a binary attack.
    2. They can use alternate encodings.
    3. They can use different characters with the same meaning.
    4. The characters could be used together to avoid the blacklist.
80. The design of the application calls for client-side validation of input. What type of tool could an attacker use to bypass this?
    1. An XSS injector
    2. A web proxy
    3. A JSON interpreter
    4. A SQL injector
81. A member of Donna's security team suggests that output encoding should also be considered. What type of attack is the team member most likely attempting to prevent?
    1. Cross-site scripting
    2. SQL injection
    3. Cross-site request forgery
    4. All of the above
82. What type of access control system uses information like age, title, organization ID, or security clearance to grant privileges?
    1. RBAC
    2. MAC
    3. DAC
    4. ABAC
83. Alex has deployed a new model of network connected Internet of Things (IoT) devices throughout his organization's facilities to track environmental data. The devices use a system on a chip (SOC) and Alex is concerned about potential attacks. What is the most likely exploit channel for SOCs in this environment?
    1. Physical attacks
    2. Attacks via an untrusted foundry
    3. Attacks against the operating system and software
    4. Side channel attacks
84. Nathan downloads a BIOS update from Dell's website, and when he attempts to install it on the PC, he receives an error that the hash of the BIOS does not match the hash stored on Dell's servers. What type of protection is this?
    1. Full-disk encryption
    2. Firmware protection
    3. Operating system protection
    4. None of the above
85. What practice is typical in a DevSecOps organization as part of a CI/CD pipeline?
    1. Automating some security gates
    2. Programmatic implementation of zero-day vulnerabilities
    3. Using security practitioners to control the flow of the CI/CD pipeline
    4. Removing security features from the IDE
86. Naomi wants to validate files that are uploaded as part of her web application. Which of the following is not a common technique to help prevent malicious file uploads or denial of service attacks?
    1. Using input validation to ensure only allowed file extensions
    2. Uploading all files to a third-party virus scanning platform like VirusTotal
    3. Checking the size of uploaded files against a maximum allowed file size
    4. Checking zip files for their structure and path before unzipping them
87. Valerie wants to prevent potential cross-site scripting attacks from being executed when previously entered information is displayed in user's browsers. What technique should she use to prevent this?
    1. A firewall
    2. A HIDS
    3. Output encoding
    4. String randomization
88. While developing a web application, Chris sets his session ID length to 128 bits based on OWASP's recommended session management standards. What reason would he have for needing such a long session ID?
    1. To avoid duplication
    2. To allow for a large group of users
    3. To prevent brute-forcing
    4. All of the above
89. Robert is reviewing a web application and the developers have offered four different responses to incorrect logins. Which of the following four responses is the most secure option?
    1. Login failed for user; invalid password
    2. Login failed; invalid user ID or password
    3. Login failed; invalid user ID
    4. Login failed; account does not exist
90. What technology is most commonly used to protect data in transit for modern web applications?
    1. VPN
    2. TLS
    3. SSL
    4. IPSec
91. Nathan is reviewing PHP code for his organization and finds the following code in the application he is assessing. What technique is the developer using?

    $stmt = $dbh->prepare("INSERT INTO REGISTRY (var1, var2) VALUES (:var1, :var2)");
    $stmt->bindParam(':var1', $var1);
    $stmt->bindParam(':var2', $var2);

    1. Dynamic binding
    2. Parameterized queries
    3. Variable limitation
    4. None of the above
92. Which of the following components is not typically part of a service-oriented architecture?
    1. Service provider
    2. Service guardian
    3. Service broker
    4. Service consumer
93. Which role in a SAML authentication flow validates the identity of the user?
    1. The SP
    2. The IDP
    3. The principal
    4. The RP
94. Anja is assessing the security of a SOAP-based web service implementation. Which of the following web service security requirements should she recommend to reduce the likelihood of a successful man-in-the-middle attack?
    1. Use TLS.
    2. Use XML input validation.
    3. Use XML output validation.
    4. Virus-scan files received by web service.
95. Which of the following components are not part of a typical SOAP message?
    1. The envelope
    2. The header
    3. The stamp
    4. The body
96. Alice wants to ensure proper access control for a public REST service. What option is best suited to help ensure that the service will not suffer from excessive use?
    1. Restricting HTTP methods
    2. Using JSON web tokens
    3. Using API keys
    4. Using HTTPS
97. How are requests in REST-based web services typically structured?
    1. As XML
    2. As a URL
    3. As a SQL query
    4. As a SOAP statement
98. While reviewing the code for a Docker-based microservice, Erik discovers the following code:

    echo "pidfile = /run/example.pid">> /etc/example.conf && 
    echo "logfile = /data/logs/example.log">> /etc/example.conf && 
    echo "loglevel = debug">> /etc/example.conf && 
    echo "port = : 5159">> /etc/example.conf && 
    echo "username = svc">> /etc/example.conf && 
    echo "password = secure">> /etc/example.conf &&  

    What has he found?

    1. A misconfigured microservice
    2. Hard-coded credentials
    3. Improperly configured log files
    4. A prohibited port
99. What type of access is typically required to compromise a physically isolated and air-gapped system?
    1. Wired network access
    2. Physical access
    3. Wireless network access
    4. None of the above, because an isolated, air-gapped system cannot be accessed
100. The organization that Allan works for wants to securely store digital keys for their enterprise security certificates. What type of device should they select to help manage and protect their keys?
     1. A hardware token
     2. A HSM
     3. A PEBKAC
     4. A cigar box CA
101. Charlene wants to provide an encrypted network connection for her users. She knows her users require a full network connection rather than application specific uses. What VPN technology should she choose?
     1. SSL
     2. TLS
     3. IPSec
     4. WPA2
102. How are eFuses used to prevent firmware downgrades?
     1. If they are burned, the firmware cannot be changed.
     2. The number of fuses burned indicates the current firmware level, preventing old versions from being installed.
     3. eFuses must be reset before firmware can be downgraded, requiring administrative access.
     4. eFuses cannot be used to prevent firmware downgrades.
103. Dev wants to use Secure Boot on a workstation. What technology must his workstation use to support Secure Boot?
     1. BIOS
     2. ROM
     3. UEFI
     4. TPM
104. What requirements must be met for a trusted execution environment to exist?
     1. All trusted execution environment assets must have been installed and started securely.
     2. The trusted execution environment must be verified and certified by a third party.
     3. The trusted execution environment must be verified and approved by the end user.
     4. Only trusted components built into the operating system can be run in a trusted execution environment.
105. What hardware feature do Apple devices use to manage keys in a secure way outside of the processor?
     1. A cryptographic bastion
     2. A Secure Enclave
     3. A HSM
     4. A cryptolocker
106. Which of the following is not a typical capability of processor security extensions?
     1. Data and instruction path integrity checks
     2. Error detection for memory and registers
     3. Stack bounds checking
     4. Secure register wiping capabilities
107. What concept describes a security process that ensures that another process or device cannot perform read or write operations on memory while an operation is occurring?
     1. Nonblocking memory
     2. Memory coherence
     3. Atomic execution
     4. Trusted execution

     Use the following scenario to answer questions 108–111.

     Tom connects to a website using the Chrome web browser. The site uses TLS encryption and presents the digital certificate shown here.

     

108. Who created the digital signature shown in the last line of this digital certificate?
     1. Starfield Services
     2. Amazon
     3. nd.edu
     4. RSA
109. Which one of the following websites would not be covered by this certificate?
     1. nd.edu
     2. www.nd.edu
     3. www.business.nd.edu
     4. All of these sites would be covered by the certificate.
110. What encryption key does the certificate contain?
     1. The website's public key
     2. The website's private key
     3. Tom's public key
     4. Tom's private key
111. After Tom initiates a connection to the website, what key is used to encrypt future communications from the web server to Tom?
     1. The website's public key
     2. The website's private key
     3. Tom's public key
     4. The session key
112. Holographic stickers are a common tool used for what type of security practice?
     1. Anti-tamper
     2. Anti-theft
     3. Asset management
     4. Asset tracking
113. Olivia has been tasked with identifying a solution that will prevent the exposure of data on a drive if the drive itself is stolen. What type of technology should she recommend?
     1. MFA
     2. SED
     3. P2PE
     4. eSATA
114. Amanda's organization wants to ensure that user awareness, documentation, and other tasks are accomplished and tracked as new infrastructure is added and modified. What type of tool should they acquire?
     1. A project management tool
     2. An IDE
     3. A change management tool
     4. A ticketing tool
115. Christina wants to check the firmware she has been provided to ensure that it is the same firmware that the manufacturer provides. What process should she follow to validate that the firmware is trusted firmware?
     1. Download the same file from the manufacturer and compare file size.
     2. Compare a hash of the file to a hash provided by the manufacturer.
     3. Run strings against the firmware to find any evidence of tempering.
     4. Submit the firmware to a malware scanning site to verify that it does not contain malware.
116. Amanda's organization uses an air-gap design to protect the HSM device that stores their root encryption certificate. How will Amanda need to access the device if she wants to generate a new certificate?

     

     1. Wirelessly from her laptop
     2. Over the wired network from her PC
     3. From a system on the air-gapped network
     4. Amanda cannot access the device without physical access to it
117. What is the key difference between a secured boot chain and a measured boot chain?
     1. A secured boot chain depends on a root of trust.
     2. A measured boot chain computes the hash of the next object in the chain and stores it securely.
     3. A secured boot chain computes the hash of the next object in the chain and stores it securely.
     4. A measured boot chain depends on a root of trust.
118. Encrypted data transmission from a CPU to a GPU is an example of what type of technology?
     1. Secure Enclave
     2. Bus encryption
     3. Hardware security module
     4. Software security module
119. Which of the following parties directly communicate with the end user during a SAML transaction?
     1. The relying party
     2. The SAML identity provider
     3. Both the relying party and the identity provider
     4. Neither the relying party nor the identity provider
120. What type of dedicated device is used in organizations that can generate keys, create and validate digital signatures, and provide cryptoprocessing to both encrypt and decrypt data?
     1. HSMs
     2. BGPs
     3. SSMs
     4. None of the above
121. Saeed wants to ensure that devices procured by his company are captured in inventory and tracked throughout their lifespan via physical inventory tracking methods. What can he do to make sure that the assets are easier to quickly identify against an asset inventory?
     1. Record them in a database
     2. Record them via paper forms
     3. Use asset tagging
     4. Use hardware address-based tagging
122. Isaac is developing a mobile application and is following the OWASP Mobile Application Security Checklist. Which of the following is a practice he should not follow?
     1. The application will use symmetric cryptography with hard-coded keys as its sole method of encryption.
     2. Data for the application will be encoded on the network using TLS any time data is sent or received.
     3. The application will use the Secure Enclave on iOS devices to store cryptographic keys.
     4. The application invalidates sessions after a predetermined period of inactivity and session tokens expire.
123. Micro-probing, applying unexpected or out of specification voltages or clock signals, and freezing a device are all examples of types of attacks prevented by what type of technique?
     1. DRM
     2. Anti-theft
     3. Anti-tamper
     4. Fault tolerance
124. Patricia wants to protect updated firmware for her organization's proprietary hardware when it is installed and is concerned about third parties capturing the information as it is transferred between the host system and the hardware device. What type of solution should she use to protect the data in transit if the device is a PCIe internal card?
     1. Bus encryption
     2. CPU encryption
     3. Full-disk encryption
     4. DRM
125. Piper wants to delete the contents of a self-encrypting drive (SED). What is the fastest way to securely do so?
     1. Use a full-drive wipe following DoD standards.
     2. Delete the encryption key for the drive.
     3. Use a degausser.
     4. Format the drive.
126. What type of module is required to enable Secure Boot and remote attestation?
     1. A TPM module
     2. A HSM
     3. A GPM
     4. An MX module
127. Although both Secure Boot and Measured Boot processes rely on a chain of trust, only one validates the objects in the chain. Which technology does this and what process does it follow?
     1. A Secured Boot chain validates the boot objects using private keys to check against public keys already in the BIOS.
     2. A Measured Boot chain computes the hash of the next object in the chain and compares it to the hash of the previous object.
     3. A Secured Boot chain computes the hash of the next object in the chain and compares it to the hash of the previous object.
     4. A Measured Boot chain validates the boot objects using private keys to check against public keys already in the BIOS.
128. What type of operation occurs in a way that prevents another processor or I/O device from reading or writing to a memory location that is in use by the operation until the operation is complete?
     1. A complete operation
     2. A fractional operation
     3. Atomic execution
     4. Perpendicular execution
129. Adil is attempting to boot a system that uses UEFI and has Secure Boot enabled. During the boot process, the system will not start because of a recognized key error. What has occurred?
     1. The user has not entered their passphrase.
     2. The drive token needs updated.
     3. A USB token is not plugged in.
     4. The operating system may not be secure.
130. Support for AES, 3DES, ECC, and SHA-256 are all examples of what?
     1. Encryption algorithms
     2. Hashing algorithms
     3. Processor security extensions
     4. Bus encryption modules
131. Bernie sets up a VPC for his organization and connects to it through a VPN. What has he created and where?
     1. A private segment of a public cloud
     2. A private segment of a local virtualization environment
     3. A public segment of a private cloud
     4. A public segment of a local virtualization environment
132. What types of attacks can API keys help prevent when used to limit access to a REST-based service?
     1. Brute-force attacks
     2. Time-of-access/time-of-use attacks
     3. Man-in-the-middle attacks
     4. Denial-of-service attacks
133. Which of the following is not a benefit of physical segmentation?
     1. Easier visibility into traffic
     2. Improved network security
     3. Reduced cost
     4. Increased performance

     Use the following diagram to answer the next three questions.

     

134. Scott has designed a redundant infrastructure, but his design still has single points of failure. Which of the single points of failure is most likely to cause an organizationwide Internet outage?
     1. Point A
     2. Point C
     3. Point E
     4. Point F
135. After identifying the single point of failure for his connectivity, Scott wants to fix the issue. What would be the best solution for the issue he identified?
     1. A second connection from the same ISP on the same fiber path
     2. A second connection from a different ISP on the same fiber path
     3. A second connection from the same ISP on a different fiber path
     4. A second connection from a different ISP on a different fiber path
136. Scott has been asked to review his infrastructure for any other critical points of failure. If point E is an edge router and individual workstations are not considered mission critical, what issue should he identify?
     1. Point D
     2. Point E
     3. Point F
     4. None of the above
137. Which of the following options is most effective in preventing known password attacks against a web application?
     1. Account lockouts
     2. Password complexity settings
     3. CAPTCHAs
     4. Multifactor authentication
138. Ben adds a unique, randomly generated string to each password before it is hashed as part of his web application's password storage process. What is this process called?
     1. Mashing
     2. Hashing
     3. Salting
     4. Peppering
139. Which of the following is not a common use case for network segmentation?
     1. Creating a VoIP network
     2. Creating a shared network
     3. Creating a guest wireless network
     4. Creating trust zones
140. Kwame discovers that secrets for a microservice have been set as environment variables on the Linux host that he is reviewing using the following command:

     docker run -it -e "DBUSER= appsrv" -e DBPASSWD=secure11" dbappsrv 

     Which processes can read the environment variables?

     1. The dbuser
     2. The Docker user
     3. All processes on the system
     4. Root and other administrative users
141. What three layers make up a software defined network?
     1. Application, Datagram, and Physical layers
     2. Application, Control, and Infrastructure layers
     3. Control, Infrastructure, and Session layers
     4. Data link, Presentation, and Transport layers
142. Which of the following is not a security advantage of VDI?
     1. No data is stored locally on the endpoint device.
     2. Patch management is easier due to use of a single central image.
     3. VDI systems cannot be infected with malware.
     4. There is isolation of business tools and files even when using personally owned devices.
143. Micah is designing a containerized application security environment and wants to ensure that the container images he is deploying do not introduce security issues due to vulnerable applications. What can he integrate into the CI/CD pipeline to help prevent this?
     1. Automated checking of application hashes against known good versions
     2. Automated vulnerability scanning
     3. Automated fuzz testing
     4. Automated updates
144. Susan wants to optimize the DevOps workflow as part of a DevSecOps initiative. What optimization method should she recommend to continuously integrate security without slowing work down?
     1. Automate some security gates.
     2. Perform security testing before development.
     3. Perform security testing only after all code is fully operational.
     4. None of the above.
145. Camille wants to integrate with a federation. What will she need to authenticate her users to the federation?
     1. An IDP
     2. A SP
     3. An API gateway
     4. A SSO server

     Answer the next three questions based on your knowledge of container security and the following scenario.

     Brandon has been tasked with designing the security model for container use in his organization. He is working from the NIST SP 800-190 document and wants to follow NIST recommendations wherever possible.

146. What can Brandon do to create a hardware-based basis for trusted computing?
     1. Only use in-house computing rather than cloud computing.
     2. Use a hardware root of trust like a TPM module and Secure Boot methods.
     3. Manually inspect hardware periodically to ensure that no keyloggers or other unexpected hardware is in place.
     4. Only use signed drivers.
147. Brandon needs to deploy containers with different purposes, data sensitivity levels, and threat postures to his container environment. How should he group them?
     1. Segment containers by purpose
     2. Segment containers by data sensitivity
     3. Segment containers by threat model
     4. All of the above
148. What issues should Brandon consider before choosing to use the vulnerability management tools he has in his non-container-based security environment?
     1. Vulnerability management tools may make assumptions about host durability.
     2. Vulnerability management tools may make assumptions about update mechanisms and frequencies.
     3. Both A and B
     4. Neither A nor B
149. Timing information, power consumption monitoring, electromagnetic emanation monitoring, and acoustic monitoring are all examples of what types of attacks against SOCs, embedded systems, and other platforms?
     1. Trusted foundry attacks
     2. Side-channel attacks
     3. Primary channel attacks
     4. Untrusted foundry attacks
150. What key functionality do enterprise privileged account management tools provide?
     1. Password creation
     2. Access control to individual systems
     3. Entitlement management across multiple systems
     4. Account expiration tools
151. Amira wants to deploy an open standard–based single sign-on (SSO) tool that supports both authentication and authorization. What open standard should she look for if she wants to federate with a broad variety of identity providers and service providers?
     1. LDAP
     2. SAML
     3. OAuth
     4. OpenID Connect
152. Nathaniel wants to use an access control system that takes into account information about resources like the resource owner, filename, and data sensitivity. What type of access control system should he use?
     1. ABAC
     2. DAC
     3. MAC
     4. RBAC
153. What secure processing technique requires an operation to be complete before the memory locations it is accessing or writing to can be used by another process?
     1. Trusted execution
     2. Atomic execution
     3. Anti-tamper
     4. Bus encryption
154. Betty wants to review the security logs on her Windows workstation. What tool should she use to do this?
     1. Secpol.msc
     2. Event Viewer
     3. Log Viewer
     4. Logview.msc
155. What type of attack is the use of query parameterization intended to prevent?
     1. Buffer overflows
     2. Cross-site scripting
     3. SQL injection
     4. Denial-of-service attacks
156. Isaac is configuring syslog on a Linux system and wants to send the logs in a way that will ensure that they are received. What protocol should he specify to do so?
     1. UDP
     2. HTTP
     3. HTTPS
     4. TCP
157. Bob wants to deploy a VPN technology with granular access controls for applications that are enforced at the gateway. Which VPN technology is best suited to this requirement?
     1. IKE VPNs
     2. TLS VPNs
     3. X.509 VPNs
     4. IPsec VPNs
158. What type of attack is output encoding typically used against?
     1. DoS
     2. XSS
     3. XML
     4. DDoS
159. Alaina wants to identify only severe kernel issues on a Linux system, and she knows that log levels for the kernel range from level 0 to level 7. Which of the following levels is the most severe?
     1. Level 1, KERN_ALERT
     2. Level 2, KERN_CRIT
     3. Level 4, KERN_WARNING
     4. Level 7, KERN_DEBUG

     Use the following scenario for questions 160–162.

     Scott has been asked to select a software development model for his organization and knows that there are a number of models that may make sense for what he has been asked to accomplish. Use your knowledge of SDLC models to identify an appropriate model for each of the following requirements.

160. Scott's organization needs basic functionality of the effort to become available as soon as possible and wants to involve the teams that will use it heavily to ensure that their needs are met. What model should Scott recommend?
     1. Waterfall
     2. Spiral
     3. Agile
     4. Rapid Application Development
161. A parallel coding effort needs to occur; however, this effort involves a very complex system and errors could endanger human lives. The system involves medical records and drug dosages, and the organization values stability and accuracy over speed. Scott knows the organization often adds design constraints throughout the process and that the model he selects must also deal with that need. What model should he choose?
     1. Waterfall
     2. Spiral
     3. Agile
     4. Rapid Application Development
162. At the end of his development cycle, what SDLC phase will Scott enter as the new application is installed and replaces the old code?
     1. User acceptance testing
     2. Testing and integration
     3. Disposition
     4. Redesign
163. Sofía wants to ensure that the ICs in the new device that her commercial consumer products company is releasing cannot be easily reverse engineered. Which technique is not an appropriate means of meeting her requirement?
     1. Use a trusted foundry.
     2. Encase the IC in epoxy.
     3. Design the chip to zeroize sensitive data if its security encapsulation fails.
     4. Design the chip to handle out of spec voltages and clock signals.
164. Charles is reviewing the certificate properties for the certificate for www.comptia.org and notices that the DNS name reads

     DNS name = *.comptia.org
     DNS name = comptia.org 

     What type of certificate is in use?

     1. A multidomain certificate
     2. A wildcard certificate
     3. A mismatched certificate
     4. An invalid certificate
165. Alaina wants to implement a modern service-oriented architecture (SOA) that relies on HTTP-based commands, works well in limited bandwidth environments, and can handle multiple data formats beyond XML. What should she build her SOA in?
     1. SOAP
     2. Waterfall
     3. REST
     4. CAVE
166. The OWASP Session Management Cheatsheet advises that session IDs are meaningless and recommends that they should be used only as an identifier on the client side. Why should a session ID not have additional information encoded in it like the IP address of the client, their username, or other information?
     1. Processing complex session IDs will slow down the service.
     2. Session IDs cannot contain this information for legal reasons.
     3. Session IDs are sent to multiple different users, which would result in a data breach.
     4. Session IDs could be decoded, resulting in data leakage.
167. Nia's honeynet shown here is configured to use a segment of unused network space that has no legitimate servers in it. What type of threats is this design particularly useful for detection?

     

     1. Zero-day attacks
     2. SQL injection
     3. Network scans
     4. DDoS attacks
168. Bounds checking, removing special characters, and forcing strings to match a limited set of options are all examples of what web application security technique?
     1. SQL injection prevention
     2. Input validation
     3. XSS prevention
     4. Fuzzing
169. Abigail is performing input validation against an input field and uses the following regular expression:

     ^(AA|AE|AP|AL|AK|AS|AZ|AR|CA|CO|CT|DE|DC|FM|FL|GA|GU|
     HI|ID|IL|IN|IA|KS|KY|LA|ME|MH|MD|MA|MI|MN|MS|MO|MT|NE|
     NV|NH|NJ|NM|NY|NC|ND|MP|OH|OK|OR|PW|PA|PR|RI|SC|SD|TN|
     TX|UT|VT|VI|VA|WA|WV|WI|WY)$ 

     What is she checking with the regular expression?

     1. She is removing all typical special characters found in SQL injection.
     2. She is checking for all U.S. state names.
     3. She is removing all typical special characters for cross-site scripting attacks.
     4. She is checking for all U.S. state name abbreviations.
170. Adam is testing code written for a client-server application that handles financial information and notes that traffic is sent between the client and server via TCP port 80. What should he check next?
     1. If the server stores data in unencrypted form
     2. If the traffic is unencrypted
     3. If the systems are on the same network
     4. If usernames and passwords are sent as part of the traffic
171. Nick wants to prevent unauthorized firmware from being installed on devices that his organization manufacturers. What technique should he use to provide an effective security layer?
     1. Encrypted firmware
     2. Signed firmware
     3. Binary firmware
     4. None of the above
172. A web server and a web browser are examples of what type of platform?
     1. Embedded
     2. Firmware
     3. Client-server
     4. SOC
173. Lara has been assigned to assess likely issues with an embedded system used for building automation and control. Which of the following software assurance issues is least likely to be of concern for her organization?
     1. Lack of updates and difficulty deploying them
     2. Long life cycle for the embedded devices
     3. Assumptions of network security where deployed
     4. Use of proprietary protocols
174. Lucca wants to prevent brute-force attacks from succeeding against a web application. Which of the following is not a commonly implemented solution to help reduce the effectiveness of brute-force attacks?
     1. Multifactor authentication
     2. Account lockouts
     3. Password reuse
     4. CAPTCHAs
175. Noam wants to ensure that he would know if the operating system, boot loader, and boot drivers of his PC were infected with malware. What type of boot process should he use to have it checked using a cryptographic hash?
     1. Manual boot hash comparison
     2. Secure Boot
     3. TPM
     4. bootsec
176. Jennifer uses an application to send randomized data to her application to determine how it responds to unexpected input. What type of tool is she using?
     1. A UAT tool
     2. A stress testing tool
     3. A fuzzer
     4. A regression testing tool
177. Isaac wants to securely handle passwords for his web application. Which of the following is not a common best practice for password storage?
     1. Use a dedicated password hash like bcrypt.
     2. Use a salt.
     3. Store passwords in an encrypted form.
     4. Set a reasonable work factor for your system.
178. Kristen wants to securely store passwords and knows that a modern password hashing algorithm is her best option. Which of the following should she choose?
     1. SHA-256
     2. bcrypt
     3. MD5
     4. SHA-512
179. Liam wants to protect data at rest in an SaaS service. He knows that he needs to consider his requirements differently in his cloud environment than an on-premises environment. What option can he use to ensure that the data is encrypted when it is stored?
     1. Install a full-disk encryption tool.
     2. Install a column-level encryption.
     3. Select an SaaS service that supports encryption at rest.
     4. Hire an independent auditor to validate the encryption.
180. Faraj wants to use statistics gained from live analysis of his network to programmatically change its performance, routing, and optimization. Which of the following technologies is best suited to his needs?
     1. Serverless
     2. Software-defined networking
     3. Physical networking
     4. Virtual private networks (VPNs)
181. Elaine's team has deployed an application to a cloud-hosted serverless environment. Which of the following security tools can she use in that environment?
     1. Endpoint antivirus
     2. Endpoint DLP
     3. IDS for the serverless environment
     4. None of the above
182. Valerie is leading an effort that will use a formal Fagan inspection of code. Which phase in the Fagan inspection process includes finding actual defects?

     

     1. Overview
     2. Preparation
     3. Inspection
     4. Rework
183. Greg wants to prevent SQL injection in a web application he is responsible for. Which of the following is not a common defense against SQL injection?
     1. Prepared statements with parameterized queries
     2. Output validation
     3. Stored procedures
     4. Escaping all user-supplied input
184. While reviewing code that generates a SQL query, Aarav notices that the “address” field is appended to the query without input validation or other techniques applied. What type of attack is most likely to be successful against code like this?
     1. DoS
     2. XSS
     3. SQL injection
     4. Teardrop
185. What type of assertion is made to an SP in a SAML authentication process?
     1. The user's password
     2. Who the user is
     3. Who the SP is
     4. What rights the user has
186. Megan wants to downgrade the firmware for a device she is working with, but when she attempts to do so, the device will not accept the older firmware. What type of hardware technology has she most likely encountered?
     1. A TPM
     2. A HSM
     3. eFuse
     4. A trusted foundry
187. Security screws are an example of what type of control?
     1. Anti-tamper
     2. Detective
     3. Anti-theft
     4. Corrective
188. What U.S. government program focuses on ensuring that integrated circuits have an assured chain of custody, a supply chain that can avoid disruption, and processes in place to protect chips from being modified or tampered with?
     1. Secure Forge
     2. DMEA
     3. Trusted foundry
     4. IC Protect
189. Michelle wants to acquire data from a self-encrypting drive. When is the data on the drive unencrypted and accessible?
     1. Data is unencrypted before the system boots.
     2. Data is unencrypted after the OS boots.
     3. Data is unencrypted only when it is read from the drive.
     4. Data is never unencrypted.
190. What term describes hardware security features built into a CPU?
     1. Atomic execution
     2. Processor security extensions
     3. Processor control architecture
     4. Trusted execution
191. Angela wants to provide her users with a VPN service and does not want them to need to use client software. What type of VPN should she set up?
     1. IPsec
     2. Air gap
     3. VPC
     4. SSL/TLS
192. Lucca needs to explain the benefits of network segmentation to the leadership of his organization. Which of the following is not a common benefit of segmentation?
     1. Decreasing the attack surface
     2. Increasing the number of systems in a network segment
     3. Limiting the scope of regulatory compliance efforts
     4. Increasing availability in the case of an issue or attack
193. Kubernetes and Docker are examples of what type of technology?
     1. Encryption
     2. Software-defined networking
     3. Containerization
     4. Serverless
194. Nathan is designing the logging infrastructure for his company and wants to ensure that a compromise of a system will not result in the loss of that system's logs. What should he do to protect the logs?
     1. Limit log access to administrators.
     2. Encrypt the logs.
     3. Rename the log files from their common name.
     4. Send the logs to a remote server.
195. After creating a new set of encryption keys for an SSH key, Allan inadvertently uploads them to GitHub as part the check-in process for software he is writing. What options does he have to fix this issue?
     1. He can modify the private key to fix the issue and then needs to re-upload it to GitHub.
     2. He needs to generate a keypair and replace it wherever it is in use.
     3. He needs to change the password for the keypair.
     4. He needs to modify the public key to fix the issue and then needs to re-upload it to GitHub.
196. What type of software testing most frequently happens during the development phase?
     1. Unit testing
     2. User acceptance testing
     3. Fuzzing
     4. Stress testing
197. What are the four phases found in the spiral SDLC model?
     1. Design, User Story Identification, Build, and Analysis
     2. Identification, Design, Build, and Evaluation
     3. Requirement Gathering, Analysis, Design, and Build
     4. User Story Identification, User Story Design, User Co-Creation, and User Acceptance Testing
198. What is the primary concept behind DevSecOps versus DevOps?
     1. Development should occur before security operations.
     2. Device security is part of operations.
     3. Security should be part of the integrated application life cycle.
     4. Operations security requires developers to play the primary security role.

     Use the following diagram and scenario for questions 199–201.

     Amanda has been assigned to lead the development of a new web application for her organization. She is following a standard SDLC model as shown here. Use the model and your knowledge of the software development life cycle to answer the following questions.

     

199. Amanda's first task is to determine if there are alternative solutions that are more cost effective than in-house development. What phase is she in?
     1. Design
     2. Operations and maintenance
     3. Feasibility
     4. Analysis and requirements definition
200. What phase of the SDLC typically includes the first code analysis and unit testing in the process?
     1. Analysis and requirements definition
     2. Design
     3. Coding
     4. Testing and integration
201. After making it through most of the SDLC process, Amanda has reached point E on the diagram. What occurs at point E?
     1. Disposition
     2. Training and transition
     3. Unit testing
     4. Testing and integration
202. Ansel knows he wants to use federated identities in a project he is working on. Which of the following should not be among his choices for a federated identity protocol?
     1. OpenID
     2. SAML
     3. OAuth
     4. Authman