- (Exam Topic 2)
Which of the following is a term related to risk management that represents the estimated frequency at which a threat is expected to transpire?

1. A. Single Loss Expectancy (SLE)
2. B. Exposure Factor (EF)
3. C. Annualized Rate of Occurrence (ARO)
4. D. Temporal Probability (TP)

Correct Answer: C

- (Exam Topic 5)
Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.
Your Corporate Information Security Policy should include which of the following?

1. A. Information security theory
2. B. Roles and responsibilities
3. C. Incident response contacts
4. D. Desktop configuration standards

Correct Answer: B

- (Exam Topic 3)
A person in your security team calls you at night and informs you that one of your web applications is potentially under attack from a cross-site scripting vulnerability. What do you do?

1. A. tell him to shut down the server
2. B. tell him to call the police
3. C. tell him to invoke the incident response process
4. D. tell him to analyze the problem, preserve the evidence and provide a full analysis and report

Correct Answer: C

- (Exam Topic 6)
A bastion host should be placed:

1. A. Inside the DMZ
2. B. In-line with the data center firewall
3. C. Beyond the outer perimeter firewall
4. D. As the gatekeeper to the organization’s honeynet

Correct Answer: C
Reference: https://www.skillset.com/questions/a-bastion-host-is-which-of-the-following

- (Exam Topic 6)
Which level of data destruction applies logical techniques to sanitize data in all user-addressable storage locations?

1. A. Purge
2. B. Clear
3. C. Mangle
4. D. Destroy

Correct Answer: B
Reference:
https://it.brown.edu/computing-policies/electronic-equipment-disposition-policy/data-removal-recommendations