Your organization is a cloud service provider and intends to assure security to customers. which of the following entities conduct security assessments based on public security standards and provide the highest level of assurance? (Wentz QOTD)
A. The audit function within an organization
B. Certification Bodies (CB) accredited by an International Accreditation Forum (IAF) member or Accreditation Body (AB)
C. Certified Public Accountants (CPA) designated by the American Institute of Certified Public Accountants (AICPA)
D. Big or first-class customers

Kerberos originated from Greek mythology, the ferocious three-headed guard dog of Hades, which comprises clients, the key distribution center (KDC), and servers. The KDC is composed of an authentication service (AS) and a ticket-granting service (TGS). Which of the following is incorrect? (Wentz QOTD)
A. Kerberos can work using DES, AES, or optionally public-key cryptography.
B. Kerberos might be subject to attacks that an attacker impersonates any user.
C. A client sends a username and password encrypted by AES to the AS for authentication.
D. The AS returns an encrypted Ticket-Granting-Ticket (TGT) to the client after authentication.

As a software developer, you are aware that various generations of programming languages have different features. Which of the following is most vulnerable to buffer overflow attacks? (Wentz QOTD)
A. Client-based applications using C
B. Server-based applications using C#
C. Data-centric applications using Java
D. Backend web applications using JavaScript

The Software-Defined Network (SDN) architecture typically divides a network into three planes, e.g., application, control, and data planes. Which of the following is not a primary SDN feature? (Wentz QOTD)
A. Virtualize switches on a commercial off-the-shelf (COTS) hardware platform.
B. Program switches on controllers to drop, flood, or forward packets.
C. Builds a virtual overlay network on top of the existing underlay network.
D. Have applications communicate with the controllers through northbound API.

You are evaluating security controls to enforce wireless security. Which of the following is least effective? (Wentz QOTD)
A. Add white noise
B. Diminish near-end crosstalk (NEXT)
C. Enable 802.1X to authenticate connection requests
D. Implement a fine metallic mesh that covers the workspace

As a security professional, you are responsible for protecting information assets. Which of the following should be conducted first to enforce information security? (Wentz QOTD)
A. Assess risk against assets
B. Classify assets based on business values
C. Assign asset owners
D. Select controls to protect assets

System functions and related data structures are typically isolated into well-defined logical units. Which of the following allows the relationships of these units to be better understood, so that dependencies are clear and undesired complexity can be avoided.? (Wentz QOTD)
A. Layering
B. Modularity
C. Abstraction
D. Encapsulation

You are developing a distributed software system. Which of the following is least likely a constituent system element? (Wentz QOTD)
A. Application programming interface (API)
B. Software development kit (SDK)
C. Interface description language (IDL)
D. Dependent processes using static libraries

It’s commonly agreed that 2015 is the year of threat intelligence sharing. The ecosystem of specifications and standards for threat intelligence sharing is getting mature. Which of the following classifies threat intelligence that might be shared and controls the scope of sharing? (Wentz QOTD)
A. Traffic Light Protocol (TLP)
B. Trusted Automated eXchange of Indicator Information (TAXII)
C. Structured Threat Information eXpression (STIX)
D. Security Content Automation Protocol (SCAP)

You are implementing an authorization mechanism based on the state machine model to prevent privilege propagation and control information flow for confidentiality. Which of the following is the best mechanism to meet the security requirements? (Wentz QOTD)
A. Identity-based access control
B. Attribute-based access control
C. Role-based access control
D. Lattice-based access control