312-50

312-50 practice questions, page 4 of 25, with answer review and explanations.

Question 16

Which of the following lists are valid data-gathering activities associated with a risk assessment?

  1. Threat identification, vulnerability identification, control analysis
  2. Threat identification, response identification, mitigation identification
  3. Attack profile, defense profile, loss profile
  4. System profile, vulnerability identification, security determination

Question 17

A penetration tester is hired to do a risk assessment of a company's DMZ. The rules of engagement states that the penetration test be done from an external IP address with no prior knowledge of the internal IT systems. What kind of test is being performed?

  1. white box
  2. grey box
  3. red box
  4. black box

Question 18

Which of the following is a detective control?

  1. Smart card authentication
  2. Security policy
  3. Audit trail
  4. Continuity of operations plan

Question 19

Which of the following is a component of a risk assessment?

  1. Physical security
  2. Administrative safeguards
  3. DMZ
  4. Logical interface

Question 20

When utilizing technical assessment methods to assess the security posture of a network, which of the following techniques would be most effective in determining whether end-user security training would be beneficial?

  1. Vulnerability scanning
  2. Social engineering
  3. Application security testing
  4. Network sniffing