Which of the following is the GREATEST advantage of application penetration testing over vulnerability
scanning?

• A.Penetration testing does not require a special skill set to be executed.
• B.Penetration testing provides a more accurate picture of gaps in application controls.
• C.Penetration testing can be conducted in a relatively short time period.
• D.Penetration testing creates relatively smaller risks to application availability and integrity.

Comment: *

Name: *

Email: *

Verification: *

An information security manager has identified and implemented migrating controls according to industry best practices. Which of the following is the GREATEST risk associated with this approach?

• A.Important security controls may be missed without senior management input.
• B.The cost of control implementation may be too high.
• C.The migration measures may not be updated in a timely manner.
• D.The security program may not be aligned with organizational objectives.

Comment: *

Name: *

Email: *

Verification: *

E-mail traffic from the Internet is routed via firewall-1 to the mail gateway. Mail is routed from the mail gateway, via firewall-2, to the mail recipients in the internal network. Other traffic is not allowed. For example, the firewalls do not allow direct traffic from the Internet to the internal network.

The intrusion detection system (IDS) detects traffic for the internal network that did not originate from the mail gateway. The FIRST action triggered by the IDS should be to:

• A.alert the appropriate staff.
• B.create an entry in the log.
• C.close firewall-2.
• D.close firewall-1.

Comment: *

Name: *

Email: *

Verification: *

.What kind of testing should programmers perform following any changes to an application or system?

• A.Unit, module, and full regression testing
• B.Module testing
• C.Unit testing
• D.Regression testing

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the BEST method for converting a file into a format suitable for data analysis in a forensic investigation?

• A.Extraction
• B.Normalization
• C.Data acquisition
• D.Imaging

Comment: *

Name: *

Email: *

Verification: *