212-89 Practice Test

212-89 Practice Test practice questions, page 5 of 7, with answer review and explanations.

Question 21

US-CERT and Federal civilian agencies use the reporting timeframe criteria in the federal agency reporting categorization. What is the timeframe required to report an incident under the CAT 4 Federal Agency category?

  1. Weekly
  2. Within four (4) hours of discovery/detection if the successful attack is still ongoing and agency is unable to successfully mitigate activity
  3. Within two (2) hours of discovery/detection
  4. Monthly

Question 22

Identify a standard national process which establishes a set of activities, general tasks and a management structure to certify and accredit systems that will maintain the information assurance (IA) and security posture of a system or site.

  1. NIASAP
  2. NIAAAP
  3. NIPACP
  4. NIACAP

Question 23

Policies are designed to protect the organizational resources on the network by establishing the set rules and procedures. Which of the following policies authorizes a group of users to perform a set of actions on a set of resources?

  1. Access control policy
  2. Audit trail policy
  3. Logging policy
  4. Documentation policy

Question 24

When an employee is terminated from his or her job, what should be the next immediate step taken by an organization?

  1. All access rights of the employee to physical locations, networks, systems, applications and data should be disabled
  2. The organization should enforce separation of duties
  3. The access requests granted to an employee should be documented and vetted by the supervisor
  4. The organization should monitor the activities of the system administrators and privileged users who have permissions to access the sensitive information

Question 25

A threat source does not present a risk if NO vulnerability that can be exercised for a particular threat source. Identify the step in which different threat sources are defined:

  1. Identification Vulnerabilities
  2. Control analysis
  3. Threat identification
  4. System characterization