Created by - Mary Smith
Excel Certification Success Practice Questions 2023 - Part 6
Questions 1. What is the purpose of a pivot chart?A) To display the results of a pivot table visuallyB) To filter and sort dataC) To perform calculations on dataD) To create custom formulas2. What is the function used to find the largest value in a range?A) AVERAGEB) MINC) COUNTD) MAX3. What is the purpose of statistical functions in Excel?A) To format cells and dataB) To sort and filter dataC) To perform mathematical and statistical calculations on dataD) To create validation rules for data entry4. What is the difference between VLOOKUP and HLOOKUP functions in Excel?A) VLOOKUP searches for values vertically while HLOOKUP searches horizontallyB) VLOOKUP is used for sorting while HLOOKUP is used to validate dataC) VLOOKUP searches for values horizontally while HLOOKUP searches verticallyD) VLOOKUP is used to validate data while HLOOKUP is used for sorting5. What is the keyboard shortcut to apply conditional formatting to a selected cell or range of cells?A) Alt + H + L + NB) Alt+H+LC) Ctrl+Shift+CD) Ctrl+Alt+C Right Answer and Explanation: 1. Right Answer: AExplanation: A pivot chart is used to display the results of a pivot table visually.2. Right Answer: DExplanation: The MAX function is used to find the largest value in a range.3. Right Answer: CExplanation: Statistical functions in Excel allow users to perform mathematical and statistical calculations on data.4. Right Answer: AExplanation: VLOOKUP searches for values vertically while HLOOKUP searches horizontally.5. Right Answer: AExplanation: .col-md-12 { -webkit-user-select: none; -ms-user-select: none; user-select: none; } .flash-sale-container{background:#134981;text-align:center;padding:2%;} p.flash-sale-text{ font-size:24px;font-family:"Poppins";letter-spacing:2px;line-height:1.4em; } span.flash-break{ display:block; } .flash-sale-text { -webkit-animation-name:flash; animation: blink 1.5s infinite; } @keyframes blink{ 0% { color: #D3585F; } 20% { color: #D3585F; } 40% { color: #FFF; } 60% { color: #FFF; } 80% { color: #D3585F; } 100% { color: #D3585F; } } @-webkit-keyframes blink{ 0% { color: #D3585F; } 20% { color: #D3585F; } 40% { color: #FFF; } 60% { color: #FFF; } 80% { color: #D3585F; } 100% { color: #D3585F; } }
More detailsPublished - Fri, 03 Mar 2023
Created by - Mary Smith
APICS Certified Supply Chain Professional CSCPPractice Questions 2023 - Part 49
Questions 1. Which of the following statements describes a continuous replenishment strategy in a retail environment?A) Retailers make replenishment decisions.B) Retailers prepare individual orders and share sales data with vendors to improve customer service.C) Vendors use sales data and prepare shipments to maintain the desired level of inventory.D) Vendors take full control of inventory policy.2. A supplier disputes a low rating generated by a company's enterprise resources planning (ERP) system. Which of the following actions by the purchasing agent is most appropriate?A) Advise the ERP information technology manager that there is a flaw in the rating system.B) Scrap the vendor rating system until the company can figure out what is wrong.C) Compare the vendor and company detail records, and interview company employees who handled the data.D) Tell the supplier that, regardless of the disputed claims, the supplier must improve performance.3. On-time delivery performance in the supply chain can best be improved by aligning required capacity with what type of capacity?A) DemonstratedB) RatedC) BudgetedD) Theoretical4. In an assemble-to-order manufacturing environment, the master production schedule is typically the schedule of:A) resources.B) customer orders.C) components and subassemblies.D) the final assembly.5. Which of the following activities occurs as part of the sales and operations planning process?A) Time fences are matched to master production schedule horizons.B) The next quarter's forecasts are presented by sales staff to finance and operations personnel at the final meeting.C) Strategic plans are adjusted based on changing operating situations.D) Plans are converted to financial projections and capacity requirements. Right Answer and Explanation: 1. Right Answer: CExplanation: 2. Right Answer: CExplanation: 3. Right Answer: AExplanation: 4. Right Answer: CExplanation: 5. Right Answer: DExplanation: .col-md-12 { -webkit-user-select: none; -ms-user-select: none; user-select: none; } .flash-sale-container{background:#134981;text-align:center;padding:2%;} p.flash-sale-text{ font-size:24px;font-family:"Poppins";letter-spacing:2px;line-height:1.4em; } span.flash-break{ display:block; } .flash-sale-text { -webkit-animation-name:flash; animation: blink 1.5s infinite; } @keyframes blink{ 0% { color: #D3585F; } 20% { color: #D3585F; } 40% { color: #FFF; } 60% { color: #FFF; } 80% { color: #D3585F; } 100% { color: #D3585F; } } @-webkit-keyframes blink{ 0% { color: #D3585F; } 20% { color: #D3585F; } 40% { color: #FFF; } 60% { color: #FFF; } 80% { color: #D3585F; } 100% { color: #D3585F; } }
More detailsPublished - Fri, 03 Mar 2023
Created by - Mary Smith
Implementing Cisco Collaboration Practice Test Questions 2023 - Part 9
Questions 1. After configuring a Cisco CallManager Express with Cisco Unity Express, inbound calls from the PSTN SIP trunk receive a ring tone for 20 seconds and then a busy signal instead of voicemail. Which configuration fixes this problem?A) Router(config)# voice service voip Router(conf-voi-serv)#allow-connections h323 to h323B) Router(config)#dial-peer voice 2 voip Router(config-dial-peer)#no vadC) Router(config)# voice service voip Router(conf-voi-serv)#allow-connections voice-mail modD) Router(config)# voice service voip Router(conf-voi-serv)#no supplementary-service sip moved-temporarily2. Which services are needed to successfully implement Cisco Extension Mobility in a standalone Cisco Unified Communications Manager server?A) Cisco TAPS Service, Cisco TFTP, and Cisco Extension MobilityB) Cisco Extended Functions, Cisco Extension Mobility, and Cisco AXL Web ServiceC) Cisco CallManager, Cisco TFTP, and Cisco CallManager SNMP ServiceD) Cisco CallManager, Cisco TFTP, and Cisco Extension Mobility3. Which two configuration parameters are prerequisites to set Native Call Queuing on Cisco Unified Communications Manager? (Choose two.)(Select 2answers)A) The maximum number of callers allowed in queue must be 10B) Cisco IP Voice Media Streaming Service must be activated on at least one node in the clusterC) Cisco RIS data collector service must be running on the same server as the Cisco CallManager serviceD) A unicast music on hold audio source must be configured4. Which two types of distribution algorithm are within a line group? (Choose two.)(Select 2answers)A) circularB) top downC) randomD) highest preference5. What is the relationship between partition, time schedule, and time period in Time-of-Day routing in Cisco Unified Communications Manager?A) A partition can have one time schedule assigned. A time schedule contains one or more time periodsB) A partition can have multiple time schedules assigned. A time schedule contains only one time periodC) A partition can have multiple time schedules assigned. A time schedule contains one or more time periodsD) A partition can have one time schedule assigned. A time schedule contains only one time period. Right Answer and Explanation: 1. Right Answer: AExplanation: 2. Right Answer: DExplanation: 3. Right Answer: B,CExplanation: 4. Right Answer: A,BExplanation: 5. Right Answer: CExplanation: .col-md-12 { -webkit-user-select: none; -ms-user-select: none; user-select: none; } .flash-sale-container{background:#134981;text-align:center;padding:2%;} p.flash-sale-text{ font-size:24px;font-family:"Poppins";letter-spacing:2px;line-height:1.4em; } span.flash-break{ display:block; } .flash-sale-text { -webkit-animation-name:flash; animation: blink 1.5s infinite; } @keyframes blink{ 0% { color: #D3585F; } 20% { color: #D3585F; } 40% { color: #FFF; } 60% { color: #FFF; } 80% { color: #D3585F; } 100% { color: #D3585F; } } @-webkit-keyframes blink{ 0% { color: #D3585F; } 20% { color: #D3585F; } 40% { color: #FFF; } 60% { color: #FFF; } 80% { color: #D3585F; } 100% { color: #D3585F; } }
More detailsPublished - Fri, 03 Mar 2023
Created by - Mary Smith
AWS ANS-C00 Certified Advanced Networking Practice Questions 2023 - Part 29
Questions 1. The company's premises network is an IP address range 152.55.0.0/16. You've been given the address for the range of 152.55.253.0/24 AWS(Amazon Web Service) Cloud. You need to plan VPC and VPC to ensure communication between the company and the premises of the network. How to implement this. Select 2 response options belowA) NoneB) VPC setup with the address 152.55.253.0/24C) VPN connection to your virtual private network gateway, make sure the route in the presence of their own on top. the router will route traffic via a virtual private gateway.D) VPN connection using the customer's gateway. Ensure the path is present in the company's premises passing through the router to route the customer's gateway.E) VPC setup with the address of 152.55.0.0/162. You have a collection of assets stored in the bucket 53. You want the users around the world use this property for the least latency. Users also have access to distribution through the company's domain name. How can you achieve this? Select 2 response options below.(Select 2answers)A) Create a web-based distribution in front of the CloudB) Create an application load balancer and point it to the S3 bucketC) Create a resource record in the zone hosted and create an alias recordD) Create a resource record in the zone hosted and create PTR3. The current web application is hosted by a number of EC2 instances, which is placed behind a load balancer application. All safety groups and NaCl has taken place security measures. What an extraordinary measure to ensure blocking attacks of malicious P DDS addressesA) You should invest in AWS(Amazon Web Service) Shield in front of the service Application Load balancerB) You should place the WAF in front of the service Application Load balancerC) Consider the more restrictive rules to the network ACLD) You should invest in AWS(Amazon Web Service) service Private Link to Application Front Load balancerE) None4. The company is hosted on AWS(Amazon Web Service) EC2 Instance. This hosted application to EC2 Instance. Nowadays, this application is currently under a number of issues. You need to inspect network packets to see what ty error that occurs? Which steps below may help to solve this problem?A) Use the VPC Flow Logs.B) Used in other cases. Setup port open ModeA � Y and sniff the traffic to analyze packetsC) Use the Cloud to view metricD) NoneE) Use the online tool provided by mentioning AWS(Amazon Web Service) partner.5. You can plan the formation of clouds in models used in the provision of infrastructure in your company account. This is the primary way in which resources can be created. In addition to the formation of clouds company wants to get automatic alerts if other resources to get created. 3 Select a service from the list below, which may help to achieve this?(Select 2answers)A) AWS ConfigB) cloud formationC) Cloud watch LogsD) Simple Notification ServiceE) AWS Lrrbd Right Answer and Explanation: 1. Right Answer: CExplanation: 2. Right Answer: A,CExplanation: 3. Right Answer: BExplanation: 4. Right Answer: EExplanation: 5. Right Answer: A,EExplanation: .col-md-12 { -webkit-user-select: none; -ms-user-select: none; user-select: none; } .flash-sale-container{background:#134981;text-align:center;padding:2%;} p.flash-sale-text{ font-size:24px;font-family:"Poppins";letter-spacing:2px;line-height:1.4em; } span.flash-break{ display:block; } .flash-sale-text { -webkit-animation-name:flash; animation: blink 1.5s infinite; } @keyframes blink{ 0% { color: #D3585F; } 20% { color: #D3585F; } 40% { color: #FFF; } 60% { color: #FFF; } 80% { color: #D3585F; } 100% { color: #D3585F; } } @-webkit-keyframes blink{ 0% { color: #D3585F; } 20% { color: #D3585F; } 40% { color: #FFF; } 60% { color: #FFF; } 80% { color: #D3585F; } 100% { color: #D3585F; } }
More detailsPublished - Fri, 03 Mar 2023
Created by - Mary Smith
AWS Certified Cloud Practitioner Certification - Part 46
Questions 1. Which of the following allows users to provision a dedicated network connection from their internal network toAWS?A) A. AWS CloudHSMB) B. AWS Direct ConnectC) C. AWS VPND) D. Amazon Connect2. Which services use AWS edge locations? (Choose two.)(Select 2answers)A) A. Amazon CloudFrontB) B. AWS ShieldC) C. Amazon EC2D) D. Amazon RDSE) E. Amazon ElastiCache3. Which service would provide network connectivity in a hybrid architecture that includes the AWS Cloud?A) A. Amazon VPCB) B. AWS Direct ConnectC) C. AWS Directory ServiceD) D. Amazon API Gateway4. Which tool can be used to compare the costs of running a web application in a traditional hosting environmentto running it on AWS?A) A. AWS Cost ExplorerB) B. AWS BudgetsC) C. AWS Cost and Usage reportD) D. AWS Total Cost of Ownership (TCO) Calculator5. What is the value of using third-party software from AWS Marketplace instead of installing third-party softwareon Amazon EC2? (Choose two)(Select 2answers)A) A. Users pay for software by the hour or month depending on licensing.B) B. AWS Marketplace enables the user to launch applications with 1-Click.C) C. AWS Marketplace data encryption is managed by a third-party vendor.D) D. AWS Marketplace eliminates the need to upgrade to newer software versions.E) E. Users can deploy third-party software without testing. Right Answer and Explanation: 1. Right Answer: BExplanation: AWS Direct Connect lets you establish a dedicated network connection between your network and one of theAWS Direct Connect locations. Using industry standard 802.1q VLANs, this dedicated connection can bepartitioned into multiple virtual interfaces. This allows you to use the same connection to access publicresources such as objects stored in Amazon S3 using public IP address space, and private resources such asAmazon EC2 instances running within an Amazon Virtual Private Cloud (VPC) using private IP space, whilemaintaining network separation between the public and private environments. Virtual interfaces can bereconfigured at any time to meet your changing needs.https://aws.amazon.com/directconnect/2. Right Answer: A,BExplanation: https://www.edureka.co/community/600/what-is-an-edge-location-in-aws3. Right Answer: BExplanation: Amazon Virtual Private Cloud (Amazon VPC) is a logically isolated, private section of the AWS Cloud to launchresources in a virtual data center in the cloud. Amazon VPC allows you to leverage multiple Availability Zones(AZ) within a region so that you can build greater fault tolerance within your workloads. You have completecontrol.https://aws.amazon.com/blogs/publicsector/aws-networking-capabilities-gives-you-choices-for-hybrid-cloud-connectivity-but-which-service-works-best-for-your-use-case/4. Right Answer: DExplanation: https://aws.amazon.com/tco-calculator/5. Right Answer: A,BExplanation: https://aws.amazon.com/partners/aws-marketplace/ .col-md-12 { -webkit-user-select: none; -ms-user-select: none; user-select: none; } .flash-sale-container{background:#134981;text-align:center;padding:2%;} p.flash-sale-text{ font-size:24px;font-family:"Poppins";letter-spacing:2px;line-height:1.4em; } span.flash-break{ display:block; } .flash-sale-text { -webkit-animation-name:flash; animation: blink 1.5s infinite; } @keyframes blink{ 0% { color: #D3585F; } 20% { color: #D3585F; } 40% { color: #FFF; } 60% { color: #FFF; } 80% { color: #D3585F; } 100% { color: #D3585F; } } @-webkit-keyframes blink{ 0% { color: #D3585F; } 20% { color: #D3585F; } 40% { color: #FFF; } 60% { color: #FFF; } 80% { color: #D3585F; } 100% { color: #D3585F; } }
More detailsPublished - Fri, 03 Mar 2023
Created by - Mary Smith
AWS Certified Security - Specialty - Part 49
Questions 1. Your IT Security department has mandated that all data on EBS volumes created for underlying EC2 Instances need to be encrypted. Which of the following can help achieve this?A) AWS KMS APIB) API Gateway with STSC) IAM Access Key (Incorrect)D) AWS Certificate Manager2. A company is hosting a website that must be accessible to users for HTTPS traffic. Also port 22 should be open for administrative purposes. Which of the following security group configurations are the MOST secure but still functional to support these requirements? Choose 2 answers from the options given below(Select 2answers)A) Port 22 coming from 10.0.0.0/16B) Port 22 coming from 0.0.0.0/0C) Port 443 coming from 10.0.0.0/16D) Port 443 coming from 0.0.0.0/03. Your company has a set of resources defined in the AWS(Amazon Web Service) Cloud. Their IT audit department has requested to get a list of resources that have been defined across the account. How can this be achieved in the easiest manner?A) Create a bash shell script with the AWS(Amazon Web Service) CLI. Query for all resources in all regions. Store the results in an S3 bucket.B) Use AWS(Amazon Web Service) Config to get the list of all resourcesC) Create a powershell script using the AWS(Amazon Web Service) CLI. Query for all resources with the tag of production.D) Use Cloud Trail to get the list of all resources4. You need to ensure that objects in an S3 bucket are available in another region. This is because of the criticality of the data that is hosted In the S3 bucket. How can you achieve this in the easiest way possible?A) Enable versioning which will copy the objects to the destination regionB) Write a script to copy the objects to another bucket in the destination regionC) Enable cross region replication for the bucketD) Create an 53 snapshot in the destination region5. Your company has a requirement to monitor all root user activity. How can this best be achieved? Choose 2 answers from the options given below. Each answer forms part of the solution(Select 2answers)A) Create a Cloudwatch Logs RuleB) Use Cloudtrail API call (Incorrect)C) Create a Cloudwatch Events RuleD) Use a Lambda function Right Answer and Explanation: 1. Right Answer: AExplanation: The AWS(Amazon Web Service) Documentation mentions the following on AWS(Amazon Web Service) KMS AWS Key Management Service (AWS KMS) is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data. AWS(Amazon Web Service) KMS is integrated with other AWS(Amazon Web Service) services including Amazon Elastic Block Store (Amazon EBS), Amazon Simple Storage Service (Amazon S3), Amazon Redshift, Amazon Elastic Transcoder, Amazon WorkMail, Amazon Relational Database Service (Amazon RDS), and others to make it simple to encrypt your data with encryption keys that you manage Option B is incorrect - The AWS(Amazon Web Service) Certificate manager can be used to generate SSL certificates that can be used to encrypt traffic in transit, but not at rest Option C is incorrect is again used for issuing tokens when using API gateway for traffic in transit. Option D is used for secure access to EC2 Instances For more information on AWS(Amazon Web Service) KMS, please visit the following url https://docs.aws.amazon.com/kms/latest/developerguide/overview.html2. Right Answer: A,DExplanation: vSince HTTPS traffic is required for all users on the Internet , Port 443 should be open on all IP addresses. For port 22 , the traffic should be restricted to an internal subnet. Option B is invalid , because this only allow traffic from a particular CIDR block and not from the internet Option C is invalid because allowing port 22 from the internet is a security risk For more information on AWS(Amazon Web Service) Security Groups, please visit the following url https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html3. Right Answer: BExplanation: The most feasible option is to use AWS(Amazon Web Service) Config. When you turn on AWS(Amazon Web Service) Config , you will get a list of resources defined in your AWS(Amazon Web Service) Account. A sample snapshot of the resources dashboard in AWS(Amazon Web Service) Config is shown below Option A is incorrect because this would give the list of production based resources and now all resources. Option B is partially correct. But this will just add more maintenance overhead. Option C is incorrect because this can be used to log API activities but not give an account of all resources For more information on AWS(Amazon Web Service) Config, please visit the below URL https://docs.aws.amazon.com/config/latest/developerguide/how-does-config-work.html4. Right Answer: CExplanation: 5. Right Answer: C,DExplanation: Below is a snippet from the AWS(Amazon Web Service) blogs on a solution Option B is invalid because you need to create a Cloudwatch Events Rule and there is such thing as a Cloudwatch Logs Rule Option D is invalid because Cloud Trail API calls can be recorded but cannot be used to send across notifications For more information on this blog article, please visit the following url https://aws.amazon.com/blogs/mt/monitor-and-notify-on-aws-account-root-user-activity/ .col-md-12 { -webkit-user-select: none; -ms-user-select: none; user-select: none; } .flash-sale-container{background:#134981;text-align:center;padding:2%;} p.flash-sale-text{ font-size:24px;font-family:"Poppins";letter-spacing:2px;line-height:1.4em; } span.flash-break{ display:block; } .flash-sale-text { -webkit-animation-name:flash; animation: blink 1.5s infinite; } @keyframes blink{ 0% { color: #D3585F; } 20% { color: #D3585F; } 40% { color: #FFF; } 60% { color: #FFF; } 80% { color: #D3585F; } 100% { color: #D3585F; } } @-webkit-keyframes blink{ 0% { color: #D3585F; } 20% { color: #D3585F; } 40% { color: #FFF; } 60% { color: #FFF; } 80% { color: #D3585F; } 100% { color: #D3585F; } }
More detailsPublished - Fri, 03 Mar 2023
Created by - Mary Smith
CISA—Certified Information Systems Auditor - Part 129
Questions 1. Which of the following method should be recommended by security professional to erase the data on the magnetic media that would be reused by another employee?A) DegaussingB) Overwrite every sector of magnetic media with pattern of 1's and 0'sC) Format magnetic mediaD) Delete File allocation table2. During an IS audit, one of your auditor has observed that some of the critical servers in your organization can be accessed ONLY by using shared/common user name and password. What should be the auditor's PRIMARY concern be with this approach?A) Password sharingB) AccountabilityC) Shared account managementD) Difficulty in auditing shared account3. Which of the following protocol is PRIMARILY used to provide confidentiality in a web based application thus protecting data sent across a client machine and a server?A) SSLB) FTPC) SSHD) S/MIME4. Which of the following method is recommended by security professional to PERMANENTLY erase sensitive data on magnetic media?A) DegaussingB) Overwrite every sector of magnetic media with pattern of 1's and 0'sC) Format magnetic mediaD) Delete File allocation table5. IS management has decided to rewrite a legacy customer relations system using fourth generation languages (4GLs). Which of the following risks is MOST often associated with system development using 4GLs?A) Inadequate screen/report design facilitiesB) Complex programming language subsetsC) Lack of portability across operating systemsD) Inability to perform data intensive operations Right Answer and Explanation: 1. Right Answer: BExplanation: Software tools can provide object reuse assurance. These tools overwrite every sector of magnetic media with a random or predetermined bit pattern. Overwrite methods are effective for all forms of electronic media with the exception of read-only optical media.For your exam you should know the information below:When media is to be reassigned (a form of object reuse), it is important that all residual data is carefully removed. Simply deleting files or formatting media does not actually remove the information. File deletion and media formatting often simply remove the pointers to the information. Providing assurance for object reuse requires specialized tools and techniques according to the type of media on which the data resides. Specialized hardware devices known as degausses can be used to erase data saved to magnetic media. The measure of the amount of energy needed to reduce the magnetic field on the media to zero is known as coercivity. It is important to make sure that the coercivity of the degasser is of sufficient strength to meet object reuse requirements when erasing data. If a degasser is used with insufficient coercivity, then a remanence of the data will exist. Remanence is the measure of the existing magnetic field on the media; it is the residue that remains after an object is degaussed or written over. Data is still recoverable even when the remanence is small. While data remanence exists, there is no assurance of safe object reuse. Some degausses can destroy drives. The security professional should exercise caution when recommending or using degausses on media for reuse.Software tools also exist that can provide object reuse assurance. These tools overwrite every sector of magnetic media with a random or predetermined bit pattern. Overwrite methods are effective for all forms of electronic media with the exception of read-only optical media. There exists a drawback to using overwrite software. During normal write operations with magnetic media, the head of the drive moves back-and-forth across the media as data is written. The track of the head does not usually follow the exact path each time. The result is a miniscule amount of data remanence with each pass. With specialized equipment, it is possible to read data that has been overwritten. To provide higher assurance in this case, it is necessary to overwrite each sector multiple times. Security practitioners should keep in mind that a one-time pass may be acceptable for noncritical information, but sensitive data should be overwritten with multiple passes.Overwrite software can also be used to clear the sectors within solid-state media such as USB thumb drives. It is suggested that physical destruction methods such as incineration or secure recycling should be considered for solid-state media that is no longer used.The last form of preventing unauthorized access to sensitive data is media destruction. Shredding, burning, grinding, and pulverizing are common methods of physically destroying media. Degaussing can also be a form of media destruction. High-power degausses are so strong in some cases that they can literally bend and warp the platters in a hard drive. Shredding and burning are effective destruction methods for non-rigid magnetic media. Indeed, some shredders are capable of shredding some rigid media such as an optical disk. This may be an effective alternative for any optical media containing nonsensitive information due to the residue size remaining after feeding the disk into the machine. However, the residue size might be too large for media containing sensitive information.Alternatively, grinding and pulverizing are acceptable choices for rigid and solid-state media. Specialized devices are available for grinding the face of optical media that either sufficiently scratches the surface to render the media unreadable or actually grinds off the data layer of the disk. Several services also exist which will collect drives, destroy them on site if requested and provide certification of completion. It will be the responsibility of the security professional to help, select, and maintain the most appropriate solutions for media cleansing and disposal.The following answers are incorrect:Degaussing -Erasing data by applying magnetic field around magnetic media. Degausses device is used to erase the data. Sometime degausses can make magnetic media unusable. So degaussing is not recommended way if magnetic media needs to be reused.Format magnetic media '' Formatting magnetic media does not erase all data. Data can be recoverable after formatting using software tools.Delete File allocation table-It will not erase all data. Data can be recoverable using software tools.Following reference(s) were/was used to create this question:CISA review manual 2014 Page number 3382. Right Answer: BExplanation: The keyword PRIMARY is used in the question. Accountability should be the primary concern if critical servers can be accessed only by using shared user id and password. It would be very difficult to track the changes done by employee on critical server.For your exam you should know the information below:Accountability -Ultimately one of the drivers behind strong identification, authentication, auditing and session management is accountability. Accountability is fundamentally about being able to determine who or what is responsible for an action and can be held responsible. A closely related information assurance topic is non-repudiation.Repudiation is the ability to deny an action, event, impact or result. Non-repudiation is the process of ensuring a user may not deny an action. Accountability relies heavily on non-repudiation to ensure users, processes and actions may be held responsible for impacts.The following contribute to ensuring accountability of actions:Strong identification -Strong authentication -User training and awareness -Comprehensive, timely and thorough monitoringAccurate and consistent audit logsIndependent audits -Policies enforcing accountabilityOrganizational behavior supporting accountabilityThe following answers are incorrect:The other options are also valid concern. But the primary concern should be accountability.Following reference(s) were/was used to create this question:CISA review manual 2014 Page number 328 and 329Official ISC2 guide to CISSP CBK 3rd Edition Page number 1143. Right Answer: AExplanation: The Secure Socket Layer (SSL) Protocol is primarily used to provide confidentiality to the information sent across clients and servers.For your exam you should know the information below:The Secure Sockets Layer (SSL) is a commonly-used protocol for managing the security of a message transmitted over a public network such as the Internet.SSL has recently been succeeded by Transport Layer Security (TLS), which is based on SSL.SSL uses a program layer located between the Internet's HypertextTransfer Protocol (HTTP) and Transport Control Protocol (TCP) layers.SSL is included as part of both the Microsoft and Netscape browsers and most Web server products.Developed by Netscape, SSL also gained the support of Microsoft and other Internet client/server developers as well and became the de facto standard until evolving into Transport Layer Security. The 'sockets' part of the term refers to the sockets method of passing data back and forth between a client and a server program in a network or between program layers in the same computer.SSL uses the public-and-private key encryption system from RSA, which also includes the use of a digital certificate. Later on SSL uses a Session Key along a Symmetric Cipher for the bulk of the data.TLS and SSL are an integral part of most Web browsers (clients) and Web servers. If a Web site is on a server that supports SSL, SSL can be enabled and specific Web pages can be identified as requiring SSL access. Any Web server can be enabled by using Netscape's SSLRef program library which can be downloaded for noncommercial use or licensed for commercial use.TLS and SSL are not interoperable. However, a message sent with TLS can be handled by a client that handles SSL but not TLS.The SSL handshake -A HTTP-based SSL connection is always initiated by the client using a URL starting with https:// instead of with http://. At the beginning of an SSL session, an SSL handshake is performed. This handshake produces the cryptographic parameters of the session. A simplified overview of how the SSL handshake is processed is shown in the diagram below.SSL Handshake -The client sends a client 'hello' message that lists the cryptographic capabilities of the client (sorted in client preference order), such as the version of SSL, the cipher suites supported by the client, and the data compression methods supported by the client. The message also contains a 28-byte random number.The server responds with a server 'hello' message that contains the cryptographic method (cipher suite) and the data compression method selected by the server, the session ID, and another random number.Note:The client and the server must support at least one common cipher suite, or else the handshake fails. The server generally chooses the strongest common cipher suite.The server sends its digital certificate. (In this example, the server uses X.509 V3 digital certificates with SSL.)If the server uses SSL V3, and if the server application (for example, the Web server) requires a digital certificate for client authentication, the server sends a'digital certificate request' message. In the 'digital certificate request' message, the server sends a list of the types of digital certificates supported and the distinguished names of acceptable certificate authorities.The server sends a server 'hello done' message and waits for a client response. Upon receipt of the server 'hello done' message, the client (the Web browser) verifies the validity of the server's digital certificate and checks that the server's 'hello' parameters are acceptable.If the server requested a client digital certificate, the client sends a digital certificate, or if no suitable digital certificate is available, the client sends a 'no digital certificate' alert. This alert is only a warning, but the server application can fail the session if client authentication is mandatory.The client sends a 'client key exchange' message. This message contains the pre-master secret, a 46-byte random number used in the generation of the symmetric encryption keys and the message authentication code (MAC) keys, encrypted with the public key of the server.If the client sent a digital certificate to the server, the client sends a 'digital certificate verify' message signed with the client's private key. By verifying the signature of this message, the server can explicitly verify the ownership of the client digital certificate.Note:An additional process to verify the server digital certificate is not necessary. If the server does not have the private key that belongs to the digital certificate, it cannot decrypt the pre-master secret and create the correct keys for the symmetric encryption algorithm, and the handshake fails.The client uses a series of cryptographic operations to convert the pre-master secret into a master secret, from which all key material required for encryption and message authentication is derived. Then the client sends a 'change cipher spec' message to make the server switch to the newly negotiated cipher suite. The next message sent by the client (the 'finished' message) is the first message encrypted with this cipher method and keys.The server responds with a 'change cipher spec' and a 'finished' message of its own.The SSL handshake ends, and encrypted application data can be sent.The following answers are incorrect:FTP - File Transfer Protocol (FTP) is a standard Internet protocol for transmitting files between computers on the Internet. Like the Hypertext Transfer Protocol(HTTP), which transfers displayable Web pages and related files, and the Simple Mail Transfer Protocol (SMTP), which transfers e-mail, FTP is an application protocol that uses the Internet's TCP/IP protocols. FTP is commonly used to transfer Web page files from their creator to the computer that acts as their server for everyone on the Internet. It's also commonly used to download programs and other files to your computer from other servers.SSH - Secure Shell (SSH) is a cryptographic network protocol for secure data communication, remote command-line login, remote command execution, and other secure network services between two networked computers. It connects, via a secure channel over an insecure network, a server and a client running SSH server and SSH client programs, respectively.S/MIME - S/MIME (Secure Multi-Purpose Internet Mail Extensions) is a secure method of sending e-mail that uses the Rivets-Shamir-Adelman encryption system.S/MIME is included in the latest versions of the Web browsers from Microsoft and Netscape and has also been endorsed by other vendors that make messaging products. RSA has proposed S/MIME as a standard to the Internet Engineering Task Force (IETF).Following reference(s) were/was used to create this question:CISA review manual 2014 Page number 352Official ISC2 guide to CISSP CBK 3rd Edition Page number 256http://publib.boulder.ibm.com/tividd/td/ITAME/SC32-1363-00/en_US/HTML/ss7aumst18.htm4. Right Answer: AExplanation: PERMANENTLY is the keyword used in the question. You need to find out data removal method which remove data permanently from magnetic media.Degaussing is the most effective method out of all provided choices to erase sensitive data on magnetic media provided magnetic media is not requiring to be reuse. Some degausses can destroy drives. The security professional should exercise caution when recommending or using degausses on media for reuse.A device that performs degaussing generates a coercive magnetic force that reduces the magnetic flux density of the storage media to zero. This magnetic force is what properly erases data from media. Data are stored on magnetic media by the representation of the polarization of the atoms. Degaussing changes this polarization (magnetic alignment) by using a type of large magnet to bring it back to its original flux (magnetic alignment).For your exam you should know the information below:When media is to be reassigned (a form of object reuse), it is important that all residual data is carefully removed.Simply deleting files or formatting the media does not actually remove the information. File deletion and media formatting often simply remove the pointers to the information. Providing assurance for object reuse requires specialized tools and techniques according to the type of media on which the data resides.Specialized hardware devices known as degausses can be used to erase data saved to magnetic media. The measure of the amount of energy needed to reduce the magnetic field on the media to zero is known as coercivity. It is important to make sure that the coercivity of the degasser is of sufficient strength to meet object reuse requirements when erasing data. If a degasser is used with insufficient coercivity, then a remanence of the data will exist.Remanence is the measure of the existing magnetic field on the media; it is the residue that remains after an object is degaussed or written over. Data is still recoverable even when the remanence is small. While data remanence exists, there is no assurance of safe object reuse. Some degausses can destroy drives.The security professional should exercise caution when recommending or using degausses on media for reuse.Software tools also exist that can provide object reuse assurance. These tools overwrite every sector of magnetic media with a random or predetermined bit pattern. Overwrite methods are effective for all forms of electronic media with the exception of read-only optical media. There is a drawback to using overwrite software. During normal write operations with magnetic media, the head of the drive moves back-and-forth across the media as data is written. The track of the head does not usually follow the exact path each time. The result is a miniscule amount of data remanence with each pass. With specialized equipment, it is possible to read data that has been overwritten.To provide higher assurance in this case, it is necessary to overwrite each sector multiple times. Security practitioners should keep in mind that a one-time pass may be acceptable for noncritical information, but sensitive data should be overwritten with multiple passes. Overwrite software can also be used to clear the sectors within solid-state media such as USB thumb drives. It is suggested that physical destruction methods such as incineration or secure recycling should be considered for solid-state media that is no longer used.The last form of preventing unauthorized access to sensitive data is media destruction. Shredding, burning, grinding, and pulverizing are common methods of physically destroying media. Degaussing can also be a form of media destruction. High-power degausses are so strong in some cases that they can literally bend and warp the platters in a hard drive.Shredding and burning are effective destruction methods for non-rigid magnetic media. Indeed, some shredders are capable of shredding some rigid media such as an optical disk. This may be an effective alternative for any optical media containing nonsensitive information due to the residue size remaining after feeding the disk into the machine.However, the residue size might be too large for media containing sensitive information. Alternatively, grinding and pulverizing are acceptable choices for rigid and solid-state media. Specialized devices are available for grinding the face of optical media that either sufficiently scratches the surface to render the media unreadable or actually grinds off the data layer of the disk. Several services also exist which will collect drives, destroy them on site if requested and provide certification of completion. It will be the responsibility of the security professional to help, select, and maintain the most appropriate solutions for media cleansing and disposal.The following answers are incorrect:Overwrite every sector of magnetic media with pattern of 1's and 0's-Less effective than degaussing provided magnetic media is not requiring to be reuse.Format magnetic media '' Formatting magnetic media does not erase all data. Data can be recoverable after formatting using software tools.Delete File allocation table-It will not erase all data. Data can be recoverable using software tools.The following reference(s) were/was used to create this question:CISA review manual 2014 Page number 338Official ISC2 guide to CISSP CBK 3rd Edition Page number 720.5. Right Answer: DExplanation: 4GLs are usually not suitable for data intensive operations. Instead, they are used mainly for graphic user interface (GUI) design or as simple query/report generators. .col-md-12 { -webkit-user-select: none; -ms-user-select: none; user-select: none; } .flash-sale-container{background:#134981;text-align:center;padding:2%;} p.flash-sale-text{ font-size:24px;font-family:"Poppins";letter-spacing:2px;line-height:1.4em; } span.flash-break{ display:block; } .flash-sale-text { -webkit-animation-name:flash; animation: blink 1.5s infinite; } @keyframes blink{ 0% { color: #D3585F; } 20% { color: #D3585F; } 40% { color: #FFF; } 60% { color: #FFF; } 80% { color: #D3585F; } 100% { color: #D3585F; } } @-webkit-keyframes blink{ 0% { color: #D3585F; } 20% { color: #D3585F; } 40% { color: #FFF; } 60% { color: #FFF; } 80% { color: #D3585F; } 100% { color: #D3585F; } }
More detailsPublished - Fri, 03 Mar 2023
Created by - Mary Smith
CISA—Certified Information Systems Auditor - Part 385
Questions 1. Which of the following would BEST help to support an auditor's conclusion about the effectiveness of an implemented data classification program?A) Detailed data classification schemeB) Access rights provisioned according to schemeC) Business use cases and scenariosD) Purchase of information management tools2. An organization is considering using production data for testing a new application's functionality. Which of the following data protection techniques would BEST ensure that personal data cannot be inadvertently recovered in test environments while also reducing the need for strict confidentiality of the data?A) Data anonymizationB) Data minimizationC) Data normalizationD) Data encryption3. Disaster recovery planning for network connectivity to a hot site over a public-switched network would be MOST likely to include:A) minimizing the number of points of presenceB) contracts for acquiring new leased linesC) reciprocal agreements with customers of that networkD) redirecting private virtual circuits4. Which of the following privacy principles ensures data controllers do not use personal data unintended ways that breach protection of data subjects?A) Data retentionB) AdequacyC) AccuracyD) Purpose limitation5. An organization's software develops need access to personally identifiable information (PII) stored in a particular data format. Which of the following would be theBEST way to protect this sensitive information while allowing the developers to use it in development and test environments?A) Data maskingB) Data encryptionC) Data tokenizationD) Data abstraction Right Answer and Explanation: 1. Right Answer: CExplanation: 2. Right Answer: AExplanation: 3. Right Answer: DExplanation: 4. Right Answer: DExplanation: 5. Right Answer: CExplanation: .col-md-12 { -webkit-user-select: none; -ms-user-select: none; user-select: none; } .flash-sale-container{background:#134981;text-align:center;padding:2%;} p.flash-sale-text{ font-size:24px;font-family:"Poppins";letter-spacing:2px;line-height:1.4em; } span.flash-break{ display:block; } .flash-sale-text { -webkit-animation-name:flash; animation: blink 1.5s infinite; } @keyframes blink{ 0% { color: #D3585F; } 20% { color: #D3585F; } 40% { color: #FFF; } 60% { color: #FFF; } 80% { color: #D3585F; } 100% { color: #D3585F; } } @-webkit-keyframes blink{ 0% { color: #D3585F; } 20% { color: #D3585F; } 40% { color: #FFF; } 60% { color: #FFF; } 80% { color: #D3585F; } 100% { color: #D3585F; } }
More detailsPublished - Fri, 03 Mar 2023
Created by - Mary Smith
Isaca COBIT 5 Certification - Part 2
Questions 1. What percentage represents F - full achievement of an attribute in an assessed process, as defined by the COBIT 5 assessment approach?A) 100%B) 85% to 100%C) 75% to 100%D) On average 85 %2. Identify the missing word in the following sentence.The definition of (?) is a collection of practices influenced by the enterprise's policies and procedures that takes input from a number of sources, manipulates the inputs and produces outputs.A) PrinciplesB) Intrinsic goalsC) Enterprise goalsD) Processes3. Which factor may indicate a need for the improved governance of enterprise IT?A) Tailoring COBIT and other supporting good practices and standards to Tit the unique context of the enterprise is requiredB) Significant incidents related to IT risk, such as data loss or project failure, have been experiencedC) A focus on quick wins and prioritizing the most beneficial improvements that are #a�»�»e*l lo implement is neededD) Key program roles and responsibilities should be defined and assigned4. Which statement describes the difference between specific and generic work products?A) Specific work products are defined at each capability level, generic work products are defined on an organizational levelB) Specific work products are associated with the IT-related goals, generic work products are associated with the higher level enterprise goalsC) Specific work products are defined for each process, generic work products are defined for all generic processes from capability level 2 to 5D) Specific work products define the objectives at activity level, generic work products define the level objectives of a process5. Which process domain is the MOST suitable for skills such as Project management and Capacity management?A) Monitor, Evaluate and Assess (MEA)B) Deliver, Service and Support (DSS)C) Build, Acquire and implement (BAI)D) Align, Plan and Organize (APO) Right Answer and Explanation: 1. Right Answer: BExplanation: 2. Right Answer: DExplanation: 3. Right Answer: BExplanation: 4. Right Answer: DExplanation: 5. Right Answer: CExplanation: .col-md-12 { -webkit-user-select: none; -ms-user-select: none; user-select: none; } .flash-sale-container{background:#134981;text-align:center;padding:2%;} p.flash-sale-text{ font-size:24px;font-family:"Poppins";letter-spacing:2px;line-height:1.4em; } span.flash-break{ display:block; } .flash-sale-text { -webkit-animation-name:flash; animation: blink 1.5s infinite; } @keyframes blink{ 0% { color: #D3585F; } 20% { color: #D3585F; } 40% { color: #FFF; } 60% { color: #FFF; } 80% { color: #D3585F; } 100% { color: #D3585F; } } @-webkit-keyframes blink{ 0% { color: #D3585F; } 20% { color: #D3585F; } 40% { color: #FFF; } 60% { color: #FFF; } 80% { color: #D3585F; } 100% { color: #D3585F; } }
More detailsPublished - Fri, 03 Mar 2023
Search
Popular categories
Latest blogs
CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Write a public review