Correct answer:

Stress testing is correct. Stress testing is used to create extreme conditions that the system would not reasonably be expected to encounter during normal conditions, to see how it reacts and how resilient it is.

Incorrect answers:

Security regression testing is incorrect. Security regression testing is the formal process by which code that has been modified is tested to ensure that no features and security characteristics were compromised by the modifications.

User acceptance testing is incorrect. User acceptance testing is designed to ensure that a piece of software meets its functional requirements, as submitted by the user community.

Integration testing is incorrect. Integration testing is designed to ensure that a piece of software or system can be successfully integrated and is interoperable with other systems.

Correct answer:

Disassembler is correct. A disassembler converts the machine language back into assembly language, which can then be analyzed by a reverse engineer.

Incorrect answers:

Decomplier is incorrect. Some decompilers exist, but those are very often not effective because there are many possible programs that would compile to a given assembly language file.

Integrated development environment is incorrect. An integrated development environment is used to write a software program but does not contain the ability to reverse engineer unknown binaries.

Assembler is incorrect. An assembler is used to turn assembly language into machine code and is normally not used to reverse engineer unknown binaries.

Correct answer:

IAM is correct. IAM is a broad term that encompasses the use of different technologies and policies to identify, authenticate, and authorize users through automated means. It usually includes user account management, access control, credential management, SSO functionality, rights and permissions management for user accounts, and the auditing and monitoring of all these items. IAM enables organizations to create and manage digital identities’ lifecycles (create, maintain, terminate) in a timely and automated fashion.

Incorrect answers:

Multifactor authentication is incorrect. Multifactor authentication (MFA) is an authentication process in which more than one authentication factor is used. It is a component of larger IAM processes.

Single-factor authentication is incorrect. Single-factor authentication is an authentication process in which only one authentication factor is used. It is a component of larger IAM processes.

Identity federation is incorrect. Identity federation is the concept of using a person’s digital identity credentials to gain access to various services, often across organizations. It is a component of larger IAM processes.

Correct answer:

Take a memory dump of the host is correct. Performing a memory dump on the host and using forensics techniques to examine the contents of the host’s memory may indicate any one of several types of attacks, including buffer overflow and other memory-based attacks.

Incorrect answers:

Manually stop and restart the application’s services is incorrect. Simply stopping and restarting services may not do anything to help the application perform better and will not give you any information on the potential cause of this incident.

Reinstall the application is incorrect. Reinstalling the application may assist in resolving the issue, but there is no guarantee it will not come up again if the application is compromised again. It also will give you no indication of the underlying cause of the incident.

Review the application logs for potential error messages is incorrect. Reviewing the application logs for potential error messages may give you additional information on the nature of the issue, but this likely will not give you any deeper information about the cause of the incident other than telling you that there are problems with memory. Performing memory forensics on the host will give you much more detailed information on the cause of the incident.

Correct answer:

The idea that the country in which data is collected has supreme legal authority over it is correct. Data sovereignty is the notion that the country in which data is collected has supreme legal authority over it; this idea is not strictly protected or enforced by treaty, and other countries may generally ignore this concept at their discretion.

Incorrect answers:

A precedent set by international law that the country in which data is stored has authority over it is incorrect. This is not the definition of data sovereignty; no single international law enforces this concept.

The notion that a citizen in any country has legal authority over his or her own data, regardless of any other country where it is processed is incorrect. This is not the definition of data sovereignty; it applies to authority by a country versus a citizen.

The notion that a country’s government is the data owner for its citizens is incorrect. This is not the definition of data sovereignty; countries have varying laws protecting the data privacy and ownership rights of their citizens.

Correct answer:

A.12.6.1 is correct. ISO/IEC 27001 control A.12.6.1 covers vulnerability management.

Incorrect answers:

Requirement 11 is incorrect. PCI DSS Requirement 11 addresses vulnerability management for credit card processors.

SP800-30r1 is incorrect. Special Publication 800-30r1 covers risk assessments under NIST standards

§164.310(a)(1) is incorrect. The HIPAA Security Rule, §164.308(a)(1)(i) requires organizations to conduct accurate and thorough vulnerability assessments and to implement security measures that are sufficient to reduce the risks presented by those assessed vulnerabilities to a reasonable level.

Correct answer:

Code review is correct. Manual code inspection by humans is generally referred to as a code review.

Incorrect answers:

Dynamic analysis is incorrect. Dynamic analysis is performed by executing the code in a sandbox to determine its behavior.

Static analysis is incorrect. In static analysis, code is reviewed using automated tools, not manually.

Fuzzing is incorrect. Fuzzing is a testing technique that sends a variety of unusual inputs to a program to see how it behaves. It is not a form of code review or analysis.

Correct answer:

An event is any occurrence that can be observed, verified, and documented; an incident is one or more related negative events that compromise an organization’s security posture is correct. An event is any occurrence that can be observed, verified, and documented; an incident is one or more related negative events that compromise an organization’s security posture.

Incorrect answers:

An incident is any occurrence that can be observed, verified, and documented; an event is a negative occurrence that compromises an organization’s security posture is incorrect. This is the opposite definition of event and incident.

An incident is a negative occurrence, and an event is a positive occurrence; either may or may not affect an organization’s security posture is incorrect. An event is classified as neither negative nor positive, and both may have an impact on the organization’s security posture.

An incident is neither negative nor positive, and an event is a neutral occurrence that may or may not compromise organizational security is incorrect. An incident is a negative event and does impact organizational security.

Correct answer:

HIPAA is correct. The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that covers the storage, use, and transmission of personal medical information and healthcare data. It outlines how security should be managed for any facility that creates, accesses, shares, or destroys medical information.

Incorrect answers:

GLBA is incorrect. The Gramm-Leach-Bliley Act (GLBA) is a law covering the protection of individual financial information and applies to banks and other financial institutions.

GDPR is incorrect. The General Data Protection Regulation (GDPR) is a European Union law that protects all private data for EU citizens.

HITECH is incorrect. The Health Information Technology for Economic and Clinical Health (HITECH) Act is a law supporting the original HIPAA act that provides funding for healthcare organizations to use electronic health records and enforces stiff fines for breaches of healthcare data.

Correct answer:

Infrastructure as a Service is correct. In an Infrastructure as a Service setup, the organization manages user data, applications, runtime environment, and all associated databases and operating systems. The cloud service provider provides the hardware and infrastructure necessary, to include the virtualization hypervisor, data storage, networking infrastructure, as well as enterprise hardware.

Incorrect answers:

Platform as a Service is incorrect. In the Platform as a Service model, only user data and applications are managed by the client organization. All other components are managed by the service provider.

Software as a Service is incorrect. In the Software as a Service model, only user data is managed by the subscribing organization. All other components are managed by the cloud service provider.

Security as a Service is incorrect. In a Security as a Service model, various components may be managed by either the cloud service organization or the subscribing organization, depending upon how the infrastructure is employed.