Security orchestration, automation, and response (SOAR) is a good practice of security operations that enables the integration, automation, and collaboration of people, processes, and technologies to respond to security incidents effectively. Which of the following is not true?
A. Security operations entail ongoing day-to-day execution of security activities to enforce the security policy.
B. Orchestration requires SOPs, playbooks, work instructions, and other process documents.
C. Playbooks provide procedures that can be executed manually or automatically.
D. A SOAR platform responds to security events through runbooks and requires no human intervention.

Continue reading →

OpenID Connect (OIDC) is a simple identity layer on top of the OAuth 2.0 protocol. OIDC implements authentication as an extension to the OAuth 2.0 authorization process. It enables Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server, as well as to obtain basic profile information about the End-User in an interoperable and REST-like manner. Which of the following statements about OIDC and OAuth 2.0 is not true?
A. OAuth 2.0 Clients using OIDC are also referred to as Relying Parties (RPs).
B. OAuth 2.0 Authentication Servers implementing OIDC are also referred to as OpenID Providers (OPs).
C. OAuth 2.0 Clients obtain authorization from the resource server to request access tokens.
D. OAuth 2.0 Clients use different authorization grants or flow to request access tokens based on their types.

Continue reading →

Your company built many information systems to support various business functions. Each system implements its own access control mechanism to enforce security policies, so much so that they are frequently not enforced consistently. As a security professional, you suggest the authorization mechanism should be removed from individual systems and implemented per XACML on a central server. Which of the following is the best role of the server?
A. Relying party
B. Identity provider (IdP)
C. Policy decision point (PDP)
D. Policy enforcement point (PEP)

Continue reading →

People, processes, and technologies (PPT) are significant components of an information security strategy. An assurance system can remove doubts and render confidence in security to stakeholders. Which of the following is not true?
A. CISSP is accredited per the stringent requirements of ISO 17024
B. CMMI is applicable to procurement in terms of software engineering
C. TCSEC prescribes a computing system shall address covert channels
D. CC assures a product with EAL7 is more secure than one with EAL 4

Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.

Your company sells toys online, supported by an E-Commerce system deployed to a PaaS. The EC system implemented and trusted federated identities from some well-known social media to streamline the order placing process. However, a new customer visiting your company’s web site still has to register for a new user account first to place orders. Which of the following is the best to address this problem?
A. Enforce Identity Assurance Level 3 (IAL3)
B. Implement LDAP to synchronize federated identities
C. Map attributes described in the SAML security assertion to a local identity
D. Create a new account just in time when a new customer logs in using a federated identity

Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.

According to Wikipedia, network virtualization is the process of combining hardware and software network resources and network functionality into a single, software-based administrative entity, a virtual network. Which of the following is not true about virtual networks?
A. Layer 2 networks may suffer flooding and denial of service attacks.
B. VLANs are subject to conflict of VLAN IDs in a multi-tenant data center.
C. VXLAN employs the MAC-over-IP mechanism that decreases the attack surface.
D. VXLAN endpoints joining one or more multicast groups may hijack MAC addresses.

Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.