156-110-s

8/9/2019 156-110-s

1/10

Looking for Real Exam Questions for IT Certification Exams!

We guarantee you can pass any IT certification exam at your first attempt with just 10-12

hours study of our guides.

Our study guides contain actual exam questions with accurate answers and detailed explanation

verified by experts and all graphics and drag-n-drop exhibits shown just as on the real test.

To test the quality of our guides, you can download the one-fourth portion of any guide from

http://www.certificationking.com absolutely free.

For pricing and placing order, please visit http://certificationking.com/order.html

We accept all major credit cards through www.paypal.com

For other payment options and any further query, feel free to mail us at

[email protected]

8/9/2019 156-110-s

2/10

QUESTION NO: 1

Checkpoint 156-110: Practice Exam

Which of the following is NOT a restriction, for partners accessing internal corporate resources

through an extranet?

A. Preventing modification of restricted information

B. Using restricted programs, to access databases and other information resourcesC. Allowing access from any location

D. Preventing access to any network resource, other than those explicitly permitted

E. Viewing inventory levels for partner products only

Answer: C

QUESTION NO: 2

Which type of Business Continuity Plan (BCP) test involves practicing aspects of the BCP, without

actually interrupting operations or bringing an alternate site on-line?

A. Structured walkthrough

B. Checklist

C. Simulation

D. Full interruption

E. Parallel

Answer: C

QUESTION NO: 3

Which of the following equations results in the Single Loss Expectancy for an asset?

A. Asset Value x %Of Loss From Realized Exposure

B. Asset Value x % Of Loss From Realized Threat

C. Annualized Rate of Occurrence / Annualized Loss Expectancy

D. Asset Value x %Of Loss From Realized Vulnerability

E. Annualized Rate of Occurrence x Annualized Loss Expectancy

Answer: B

QUESTION NO: 4

Which of the following is an integrity requirement for Remote Offices/Branch Offices (ROBOs)?

www.CertificationKing.com 2

8/9/2019 156-110-s

3/10


A. Private data must remain internal to an organization.

B. Data must be consistent between ROBO sites and headquarters.

C. Users must be educated about appropriate security policies.

D. Improvised solutions must provide the level of protection required.

E. Data must remain available to all remote offices.

Answer: B

QUESTION NO: 5

Operating-svstem fingerprinting uses all of the following, EXCEPT ______, to identify a target

operating system.

A. Sequence Verifier

B. Initial sequence number

C. Address spoofing

D. Time to Live

E. IP ID field

Answer: C

QUESTION NO: 6

Internal intrusions are loosely divided into which categories? (Choose TWO.)

A. Attempts by insiders to perform appropriate acts, on information assets to which they have

been given rights or permissions.

B. Attempts by insiders to access resources, without proper access rights

C. Attempts by insiders to access external resources, without proper access rights.

D. Attempts by insiders to perform inappropriate acts, on external information assets to which they

have been given rights or permissions.E. Attempts by insiders to perform inappropriate acts, on information assets to which they have

been given rights or permissions.

Answer: B,E

QUESTION NO: 7

_________ occurs when an individual or process acquires a higher level of privilege. Or access,

than originally intended.


8/9/2019 156-110-s

4/10

A. Security Triad

B. Privilege aggregation

C. Need-to-know

D. Privilege escalation

E. Least privilege

Answer: D

QUESTION NO: 8


Which encryption algorithm has the highest bit strength?

A. AES

B. Blowfish

C. DES

D. CAST

E. Triple DES

Answer: A

QUESTION NO: 9

How is bogus information disseminated?

A. Adversaries sort through trash to find information.

B. Adversaries use anomalous traffic patterns as indicators of unusual activity. They will employ

other methods, such as social engineering, to discover the cause of the noise.

C. Adversaries use movement patterns as indicators of activity.

D. Adversaries take advantage of a person's trust and goodwill.

E. Seemingly, unimportant pieces of data may yield enough information to an adversary, for him to

disseminate incorrect information and sound authoritative,

Answer: E

QUESTION NO: 10

Which type of Business Continuity Plan (BCP) test involves shutting down z on-line, and moving

all operations to the alternate site?

A. Parallel

B. Full interruption


8/9/2019 156-110-s

5/10

C. Checklist

D. Structured walkthrough

E. Simulation

Answer: B

QUESTION NO: 11


What must system administrators do when they cannot access a complete i testing?

A. Extrapolate results from a limited subset.

B. Eliminate the testing phase of change control.

C. Request additional hardware and software.

D. Refuse to implement change requests.

E. Deploy directly to the production environment.

Answer: A

QUESTION NO: 12

To protect its information assets, ABC Company purchases a safeguard that costs $60,000. The

annual cost to maintain the safeguard is estimated to be $40,000. The aggregate Annualized Loss

Expectancy for the risks the safeguard is expected to mitigate is $50,000.

At this rate of return, how long will it take ABC Company to recoup the cost of the safeguard?

A. ABC Company will never recoup the cost of this safeguard.

B. Less than 7 years

C. Less than 3 years

D. Less than 1 year

E. Less than 5 years

Answer: B

QUESTION NO: 13

Which of the following is NOT an auditing function that should be performed regularly?

A. Reviewing IDS alerts

B. Reviewing performance logsC. Reviewing IDS logs

D. Reviewing audit logs


8/9/2019 156-110-s

6/10

E. Reviewing system logs

Answer: B

QUESTION NO: 14


Which TWO of the following items should be accomplished, when interviewing candidates for a

position within an organization?

A. Hire an investigation agency to run background checks.

B. Verify all dates of previous employment.

C. question candidates, using polygraphs, n

D. Contact personal and professional references.

E. Run criminal-background checks.

Answer: B,D

QUESTION NO: 15

Which of these metrics measure how a biometric device performs, when attempting to

authenticate subjects? (Choose THREE.)

A. False Rejection Rate

B. User Acceptance Rate

C. Crossover Error Rate

D. False Acceptance Rate

E. Enrollment Failure Rate

Answer: A,C,D

QUESTION NO: 16

A new U.S. Federal Information Processing Standard specifies a cryptographic algorithm. This

algorithm is used by

A. Triple DES

B. Blowfish

C. AES

D. CASTE. RSA


8/9/2019 156-110-s

7/10

Answer: C

QUESTION NO: 17


Which of the following is likely in a small-business environment?

A. Most small businesses employ a full-time information-technology staff.

B. Resources are available as needed.

C. Small businesses have security personnel on staff.

D. Most employees have experience with information security.

E. Security budgets are very small.

Answer: E

QUESTION NO: 18

When attempting to identify OPSEC indicators, information-security professionals must: (Choose

THREE.)

A. Discover the information daily activities yield.

B. Meet with adversaries.

C. Perform business impact analysis surveys.

D. Scrutinize their organizations' daily activities.

E. Analyze indicators, to determine the information an adversary can glean?Both from routine and

nonroutine activities.

Answer: A,D,E

QUESTION NO: 19

Why should each system user and administrator have individual accounts? (Choose TWO.)

A. Using generic user names and passwords increases system security and reliability.

B. Using separate accounts for each user reduces resource consumption, particularly disk space.

C. By using individual login names and passwords, user actions can be traced.

D. If users do not have individual login names, processes can automatically run with

root/administrator access.

E. A generic user name and password for users and security administrators provides anonymity,

which prevents useful logging and auditing.

Answer: C,E


8/9/2019 156-110-s

8/10

QUESTION NO: 20


Organizations____________ risk, when they convince another entity to assume the risk for them.

A. ElevateB. Assume

C. Deny

D. Transfer

E. Mitigate

Answer: D

QUESTION NO: 21

Which of the following best describes an external intrusion attempt on a local-area network (LAN)?

A. Internal users try to gain unauthorized access to information assets outside the organizational

perimeter.

B. External-intrusion attempts from sources outside the LAN are not granted permissions or rights

to an organization's information assets

C. External users attempt to access public resources.

D. External intruders attempt exploitation of vulnerabilities, to remove their own access. E. Internal

users perform inappropriate acts on assets to which they have been given rights or permissions.

Answer: B

QUESTION NO: 22

_________ intrusion detection involves comparing traffic to known characteristics of malicioustraffic, known as attack signatures.

A. Pattern matching

B. Statistical anomaly

C. Behavioral analysis

D. Host

E. Network

Answer: A


8/9/2019 156-110-s

9/10

QUESTION NO: 23


If a firewall receives traffic not explicitly permitted by its security policy, what should the firewall

do?

A. Nothing

B. Do not log and drop the traffic.C. Log and drop the traffic.

D. Log and pass the traffic.

E. Do not log and pass the traffic.

Answer: C

QUESTION NO: 24

Which of the following statements about encryption's benefits is false? Encryption can: (Choose

TWO.)

A. significantly reduce the chance information will be modified by unauthorized entities.

B. only be used to protect data in transit. Encryption provides no protection to stored data.

C. allow private information to be sent over public networks, in relative safety.

D. significantly reduce the chance information will be viewed by unauthorized entities.

E. prevent information from being destroyed by malicious entities, while in transit.

Answer: B,E

QUESTION NO: 25

Digital signatures are typically provided by a _______, where a third party verifies a key's

authenticity.

A. Network firewall

B. Security administrator

C. Domain controller

D. Certificate Authority

E. Hash function

Answer: D

QUESTION NO: 26


8/9/2019 156-110-s

10/10


Which types of security solutions should a home user deploy? (Choose TWO.)

A. Managed Security Gateway

B. Access control lists on a router

C. Personal firewall

D. Network intrusion-detection system

E. Anti-virus software

Answer: C,E

QUESTION NO: 27

Which type of access management uses information about job duties and positions, to indicate

subjects' clearance levels?

A. Discretionary

B. Role-based

C. Nondiscretionary

D. Hybrid

E. Mandatory

Answer: B

QUESTION NO: 28

Which of the following is a cost-effective solution for securely transmitting data between remote

offices?

A. Standard e-mail

B. Fax machine

C. Virtual private network

D. Bonded courier

E. Telephone

Answer: C

QUESTION NO: 29

_________ educate(s) security administrators and end users about organizations' securitypolicies.


156-110-s

Documents

Transcript of 156-110-s