Chapter 11: Practice Test 3 443
C. Record retention policies describe how long the organization should retain data and
may also specify how and when destruction should occur. Classification policies describe
how and why classification should occur and who is responsible, whereas availability and
audit policies may be created for specific purposes.
A. The goal of the business continuity planning process is to ensure that your recovery
time objectives are all less than your maximum tolerable downtimes.
C. The Remediation phase of incident handling focuses on conducting a root cause
analysis to identify the factors contributing to an incident and implementing new security
controls, as needed.
A. The S/MIME secure email format uses the P7S format for encrypted email messages. If
the recipient does not have a mail reader that supports S/MIME, the message will appear
with an attachment named smime.p7s.
A. Aggregation is a security issue that arises when a collection of facts has a higher
classification than the classification of any of those facts standing alone. An inference
problem occurs when an attacker can pull together pieces of less sensitive information
from multiple sources and use them to derive information of greater sensitivity. In this
case, only a single source was used. SQL injection is a web application exploit. Multilevel
security is a system control that allows the simultaneous processing of information at
different classification levels.
B. Polyinstantiation allows the storage of multiple different pieces of information in a
database at different classification levels to prevent attackers from conducting aggregation
or inference attacks. Kim could store incorrect location information in the database
at lower classification levels to prevent the aggregation attack in this scenario. Input
validation, server-side validation, and parameterization are all techniques used to prevent
web application attacks and are not effective against inference attacks.
B. The tail number is a database field because it is stored in the database. It is also a
primary key because the question states that the database uniquely identifies aircraft using
this field. Any primary key is, by definition, also a candidate key. There is no information
provided that the tail number is a foreign key used to reference a different database table.
B. Foreign keys are used to create relationships between tables in a database. The
database enforces referential integrity by ensuring that the foreign key used in a table has a
corresponding record with that value as the primary key in the referenced table.
B. The waterfall model uses an approach that develops software sequentially, spending
quite a bit of time up front on the development and documentation of requirements and
design. The spiral and Agile models focus on iterative development and are appropriate
when requirements are not well understood or iterative development is preferred. DevOps
is an approach to integrating development and operations activities and is not an SDLC
model.
A. The data owner is a senior manager who bears ultimate responsibility for data
protection tasks. The data owner typically delegates this responsibility to one or more data
custodians.