Quiz
CISSP
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (125)
1Chapter 1: Security and Risk Management
When can executives be charged with negligence?
pag.218- AIf they follow the transborder laws
- BIf they do not properly report and prosecute attackers
- CIf they properly inform users that they may be monitored
- DIf they do not practice due care when protecting resources
2Chapter 1: Security and Risk Management
To better deal with computer crime, several legislative bodies have taken what steps in their strategy?
pag.218- AExpanded several privacy laws
- BBroadened the definition of property to include data
- CRequired corporations to have computer crime insurance
- DRedefined transborder issues
3Chapter 1: Security and Risk Management
Which factor is the most important item when it comes to ensuring security is successful in an organization?
pag.218- ASenior management support
- BEffective controls and implementation methods
- CUpdated and relevant security policies and procedures
- DSecurity awareness by all employees
4Chapter 1: Security and Risk Management
Which of the following standards would be most useful to you in ensuring your information security management system follows industry best practices?
pag.218- ANIST SP 800-53
- BSix Sigma
- CISO/IEC 27000 series
- DCOSO IC
5Chapter 1: Security and Risk Management
Which of the following is true about data breaches?
pag.218- AThey are exceptionally rare.
- BThey always involve personally identifiable information (PII).
- CThey may trigger legal or regulatory requirements
- DThe United States has no laws pertaining to data breaches.
6Chapter 1: Security and Risk Management
When is it acceptable to not take action on an identified risk?
pag.218- ANever. Good security addresses and reduces all risks.
- BWhen political issues prevent this type of risk from being addressed.
- CWhen the necessary countermeasure is complex.
- DWhen the cost of the countermeasure outweighs the value of the asset and potential loss.
7Chapter 1: Security and Risk Management
Which is the most valuable technique when determining if a specific security control should be implemented?
pag.218- ARisk analysis
- BCost/benefit analysis
- CALE results
- DIdentifying the vulnerabilities and threats causing the risk
8Chapter 1: Security and Risk Management
Which best describes the purpose of the ALE calculation?
pag.218- AQuantifies the security level of the environment
- BEstimates the loss possible for a countermeasure
- CQuantifies the cost/benefit result
- DEstimates the loss potential of a threat in a span of a year
9Chapter 1: Security and Risk Management
How do you calculate residual risk?
pag.218- AThreats × risks × asset value
- B(Threats × asset value × vulnerability) × risks
- CSLE × frequency = ALE
- D(Threats × vulnerability × asset value) × controls gap
10Chapter 1: Security and Risk Management
Why should the team that will perform and review the risk analysis information be made up of people in different departments?
pag.219- ATo make sure the process is fair and that no one is left out.
- BIt shouldn’t. It should be a small group brought in from outside the organization because otherwise the analysis is biased and unusable.
- CBecause people in different departments understand the risks of their department. Thus, it ensures the data going into the analysis is as close to reality as possible.
- DBecause the people in the different departments are the ones causing the risks, so they should be the ones held accountable.
11Chapter 1: Security and Risk Management
Which best describes a quantitative risk analysis?
pag.219- AA scenario-based analysis to research different security threats
- BA method used to apply severity levels to potential loss, probability of loss, and risks
- CA method that assigns monetary values to components in the risk assessment
- DA method that is based on gut feelings and opinions
12Chapter 1: Security and Risk Management
Why is a truly quantitative risk analysis not possible to achieve?
pag.219- AIt is possible, which is why it is used.
- BIt assigns severity levels. Thus, it is hard to translate into monetary values.
- CIt is dealing with purely quantitative elements.
- DQuantitative measures must be applied to qualitative elements
13Chapter 1: Security and Risk Management
What is COBIT and where does it fit into the development of information security systems and security programs?
pag.219- ALists of standards, procedures, and policies for security program development
- BCurrent version of ISO 17799
- CA framework that was developed to deter organizational internal fraud
- DOpen standards for control objectives
14Chapter 1: Security and Risk Management
What is the ISO/IEC 27799 standard?
pag.219- AA standard on how to protect personal health information
- BThe new version of BS 17799
- CDefinitions for the new ISO 27000 series
- DThe new version of NIST SP 800-60
15Chapter 1: Security and Risk Management
OCTAVE, NIST SP 800-30, and AS/NZS 4360 are different approaches to carrying out risk management within companies and organizations. What are the differences between these methods?
pag.219- ANIST SP 800-30 and OCTAVE are corporate based, while AS/NZS is international.
- BNIST SP 800-30 is IT based, while OCTAVE and AS/NZS 4360 are corporate based.
- CAS/NZS is IT based, and OCTAVE and NIST SP 800-30 are assurance based.
- DNIST SP 800-30 and AS/NZS are corporate based, while OCTAVE is international.
16Chapter 1: Security and Risk Management
What is one of the first steps in developing a business continuity plan?
pag.222- AIdentify a backup solution.
- BPerform a simulation test.
- CPerform a business impact analysis.
- DDevelop a business resumption plan.
17Chapter 1: Security and Risk Management
The purpose of initiating emergency procedures right after a disaster takes place is to prevent loss of life and injuries, and to _______________.
pag.222- Asecure the area to ensure that no looting or fraud takes place
- Bmitigate further damage
- Cprotect evidence and clues
- Dinvestigate the extent of the damages
18Chapter 1: Security and Risk Management
The term used to denote a potential cause of an unwanted incident, which may result in harm to a system or organization is
pag.222- AVulnerability
- BExploit
- CThreat
- DAttacker
19Chapter 1: Security and Risk Management
A CISSP candidate signs an ethics statement prior to taking the CISSP examination. Which of the following would be a violation of the (ISC)2 Code of Ethics that could cause the candidate to lose his or her certification?
pag.222- AE-mailing information or comments about the exam to other CISSP candidates
- BSubmitting comments on the questions of the exam to (ISC)2
- CSubmitting comments to the board of directors regarding the test and content of the class
- DConducting a presentation about the CISSP certification and what the certification means
20Chapter 2: Asset Security
Which of the following statements is true about the information life cycle?
pag.243- AThe information life cycle begins with its archival and ends with its classification.
- BMost information must be retained indefinitely.
- CThe information life cycle begins with its acquisition/creation and ends with
its disposal/destruction. - DPreparing information for use does not typically involve adding metadata to it.
21Chapter 2: Asset Security
Ensuring data consistency is important for all the following reasons, except..
pag.243- AReplicated data sets can become desynchronized.
- BMultiple data items are commonly needed to perform a transaction.
- CData may exist in multiple locations within our information systems.
- DMultiple users could attempt to modify data simultaneously.
22Chapter 2: Asset Security
Which of the following makes the most sense for a single organization’s classification levels for data?
pag.243- AUnclassified, Secret, Top Secret
- BPublic, Releasable, Unclassified
- CSensitive, Sensitive But Unclassified (SBU), Proprietary
- DProprietary, Trade Secret, Private
23Chapter 2: Asset Security
Which of the following is the most important criterion in determining the classification of data?
pag.243- AThe level of damage that could be caused if the data were disclosed
- BThe likelihood that the data will be accidentally or maliciously disclosed
- CRegulatory requirements in jurisdictions within which the organization is
not operating - DThe cost of implementing controls for the data
24Chapter 2: Asset Security
The effect of data aggregation on classification levels is best described by which of the following?
pag.244- AData classification standards apply to all the data within an organization.
- BAggregation is a disaster recovery technique with no effect on classification.
- CA low-classification aggregation of data can be deconstructed into higherclassification data items.
- DItems of low-classification data combine to create a higher-classification set.
25Chapter 2: Asset Security
Who bears ultimate responsibility for the protection of assets within the organization?
pag.244- AData owners
- BCyber insurance providers
- CSenior management
- DSecurity professionals
26Chapter 2: Asset Security
During which phase or phases of the information life cycle can cryptography be an effective control?
pag.244- AUse
- BArchival
- CDisposal
- DAll the above
27Chapter 2: Asset Security
A transition into the disposal phase of the information life cycle is most commonly triggered by..
pag.244- ASenior management
- BInsufficient storage
- CAcceptable use policies
- DData retention policies
28Chapter 2: Asset Security
Information classification is most closely related to which of the following?
pag.244- AThe source of the information
- BThe information’s destination
- CThe information’s value
- DThe information’s age
29Chapter 2: Asset Security
The data owner is most often described by all of the following except..
pag.244- AManager in charge of a business unit
- BUltimately responsible for the protection of the data
- CFinancially liable for the loss of the data
- DUltimately responsible for the use of the data
30Chapter 2: Asset Security
Data at rest is commonly..
Pag.244- AUsing a RESTful protocol for transmission
- BStored in registers
- CBeing transmitted across the network
- DStored in external storage devices
31Chapter 2: Asset Security
Data in motion is commonly..
pag.244- AUsing a RESTful protocol for transmission
- BStored in registers
- CBeing transmitted across the network
- DStored in external storage devices
32Chapter 2: Asset Security
Data in use is commonly..
pag,244- AUsing a RESTful protocol for transmission
- BStored in registers
- CBeing transmitted across the network
- DStored in external storage devices
33Chapter 2: Asset Security
Who has the primary responsibility of determining the classification level for information?
pag.244- AThe functional manager
- BSenior management
- CThe owner
- DThe user
34Chapter 2: Asset Security
If different user groups with different security access levels need to access the same information, which of the following actions should management take?
pag.244- ADecrease the security level on the information to ensure accessibility and usability of the information .
- BRequire specific written approval each time an individual needs to access the information.
- CIncrease the security controls on the information
- DDecrease the classification label on the information.
35Chapter 2: Asset Security
What should management consider the most when classifying data?
pag.245- Ahe type of employees, contractors, and customers who will be accessing the data
- BAvailability, integrity, and confidentiality
- CAssessing the risk level and disabling countermeasures
- DThe access controls that will be protecting the data
36Chapter 2: Asset Security
Who is ultimately responsible for making sure data is classified and protected?
pag.245- AData owners
- BUsers
- CAdministrators
- DManagement
37Chapter 2: Asset Security
Which of the following requirements should the data retention policy address?
pag.245- ALegal
- BRegulatory
- COperational
- DAll the above
38Chapter 2: Asset Security
Which of the following best describes an application of cryptography to protect data at rest?
pag.245- AVPN
- BDegaussing
- CWhole-disk encryption
- DUp-to-date antivirus software
39Chapter 2: Asset Security
Which of the following best describes an application of cryptography to protect data in motion?
pag.245- ATesting software against side-channel attacks
- BTLS
- CWhole-disk encryption
- DEDLP
40Chapter 3: Security Engineering
What is the final step in authorizing a system for use in an environment?
pag.471- ACertification
- BSecurity evaluation and rating
- CAccreditation
- DVerification
41Chapter 3: Security Engineering
What feature enables code to be executed without the usual security checks?
pag.471- ATemporal isolation
- BMaintenance hook
- CRace conditions
- DProcess multiplexing
42Chapter 3: Security Engineering
If a component fails, a system should be designed to do which of the following?
pag.471- AChange to a protected execution domain
- BChange to a problem state
- CChange to a more secure state
- DRelease all data held in volatile memory
43Chapter 3: Security Engineering
The trusted computing base (TCB) contains which of the following?
pag.471- AAll trusted processes and software components
- BAll trusted security policies and implementation mechanisms
- CAll trusted software and design mechanisms
- DAll trusted software and hardware components
44Chapter 3: Security Engineering
What is the imaginary boundary that separates components that maintain security from components that are not security related?
pag.471- AReference monitor
- BSecurity kernel
- CSecurity perimeter
- DSecurity policy
45Chapter 3: Security Engineering
What is the best description of a security kernel from a security point of view?
pag.471- AReference monitor
- BResource manager
- CMemory mapper
- DSecurity perimeter
46Chapter 3: Security Engineering
In secure computing systems, why is there a logical form of separation used between processes?
pag.471- AProcesses are contained within their own security domains so each does not make unauthorized accesses to other processes or their resources.
- BProcesses are contained within their own security perimeter so they can only access protection levels above them.
- CProcesses are contained within their own security perimeter so they can only access protection levels equal to them.
- DThe separation is hardware and not logical in nature.
47Chapter 3: Security Engineering
What type of rating is used within the Common Criteria framework?
pag.471- APP
- BEPL
- CEAL
- DA–D
48Chapter 3: Security Engineering
Which of the following is a true statement pertaining to memory addressing?
pag.471- AThe CPU uses absolute addresses. Applications use logical addresses. Relative addresses are based on a known address and an offset value
- BThe CPU uses logical addresses. Applications use absolute addresses. Relative addresses are based on a known address and an offset value
- CThe CPU uses absolute addresses. Applications use relative addresses. Logical addresses are based on a known address and an offset value.
- DThe CPU uses absolute addresses. Applications use logical addresses. Absolute addresses are based on a known address and an offset value
49Chapter 3: Security Engineering
Pete is a new security manager at a financial institution that develops its own internal software for specific proprietary functionality. The financial institution has several locations distributed throughout the world and has bought several individual companies over the last ten years, each with its own heterogeneous environment. Since each purchased company had its own unique environment, it has been difficult to develop and deploy internally developed software in an effective manner that meets all the necessary business unit requirements.
Which of the following best describes a standard that Pete should ensure the software development team starts to implement so that various business needs can be met?
pag.471- AISO/IEC 42010
- BCommon Criteria
- CISO/IEC 43010
- DISO/IEC 15408
50Chapter 3: Security Engineering
Mark is a security administrator who is responsible for purchasing new computer systems for a co-location facility his company is starting up. The company has several time-sensitive applications that require extensive processing capabilities. The co-location facility is not as large as the main facility, so it can only fit a smaller number of computers, which still must carry the same processing load as the systems in the main building.
Which of the following best describes the most important aspects of the products Mark needs to purchase for these purposes?
pag.471- ASystems must provide symmetric multiprocessing capabilities and virtualized environments.
- BSystems must provide asymmetric multiprocessing capabilities and virtualized environments.
- CSystems must provide multiprogramming multiprocessing capabilities and virtualized environments.
- DSystems must provide multiprogramming multiprocessing capabilities and symmetric multiprocessing environments.
51Chapter 3: Security Engineering
Which of the following is a U.S. federal government algorithm developed for creating secure message digests?
pag.473- AData Encryption Algorithm
- BDigital Signature Standard
- CSecure Hash Algorithm
- DData Signature Algorithm
52Chapter 3: Security Engineering
Which of the following best describes the difference between HMAC and CBC-MAC?
pag.473- AHMAC creates a message digest and is used for integrity; CBC-MAC is used to encrypt blocks of data for confidentiality.
- BHMAC uses a symmetric key and a hashing algorithm; CBC-MAC uses the first block for the checksum.
- CHMAC provides integrity and data origin authentication; CBC-MAC uses a block cipher for the process of creating a MAC
- DHMAC encrypts a message with a symmetric key and then puts the result through a hashing algorithm; CBC-MAC encrypts the whole message.
53Chapter 3: Security Engineering
What is an advantage of RSA over DSA?
Pag.473- AIt can provide digital signature and encryption functionality.
- BIt uses fewer resources and encrypts faster because it uses symmetric keys
- CIt is a block cipher rather than a stream cipher.
- DIt employs a one-time encryption pad.
54Chapter 3: Security Engineering
What is used to create a digital signature?
pag.473- AThe receiver’s private key
- BThe sender’s public key
- CThe sender’s private key
- DThe receiver’s public key
55Chapter 3: Security Engineering
Which of the following best describes a digital signature?
pag.473- AA method of transferring a handwritten signature to an electronic document
- BA method to encrypt confidential information
- CA method to provide an electronic signature and encryption
- DA method to let the receiver of the message prove the source and integrity of a message
56Chapter 3: Security Engineering
How many bits make up the effective length of the DES key?
pag.473- A56
- B64
- C32
- D16
57Chapter 3: Security Engineering
Why would a certificate authority revoke a certificate?
pag.473- AIf the user’s public key has become compromised
- BIf the user changed over to using the PEM model that uses a web of trust
- CIf the user’s private key has become compromised
- DIf the user moved to a new location
58Chapter 3: Security Engineering
What does DES stand for?
pag.473- AData Encryption System
- BData Encryption Standard
- CData Encoding Standard
- DData Encryption Signature
59Chapter 3: Security Engineering
Which of the following best describes a certificate authority?
pag.473- AAn organization that issues private keys and the corresponding algorithms
- BAn organization that validates encryption processes
- CAn organization that verifies encryption keys
- DAn organization that issues certificates
60Chapter 3: Security Engineering
What does DEA stand for?
pag.473- AData Encoding Algorithm
- BData Encoding Application
- CData Encryption Algorithm
- DDigital Encryption Algorithm
61Chapter 3: Security Engineering
Who was involved in developing the first public key algorithm?
pag.474- AAdi Shamir
- BRoss Anderson
- CBruce Schneier
- DMartin Hellman
62Chapter 3: Security Engineering
What process usually takes place after creating a DES session key?
pag.474- AKey signing
- BKey escrow
- CKey clustering
- DKey exchange
63Chapter 3: Security Engineering
Which of the following is a true statement pertaining to data encryption when it is used to protect data?
pag.473- AIt verifies the integrity and accuracy of the data.
- BIt requires careful key management.
- CIt does not require much system overhead in resources.
- DIt requires keys to be escrowed.
64Chapter 3: Security Engineering
If different keys generate the same ciphertext for the same message, what is this called?
pag.474- ACollision
- BSecure hashing
- CMAC
- DKey clustering
65Chapter 3: Security Engineering
What is the definition of an algorithm’s work factor?
Pag.474- AThe time it takes to encrypt and decrypt the same plaintext
- BThe time it takes to break the encryption
- CThe time it takes to implement 16 rounds of computation
- DThe time it takes to apply substitution functions
66Chapter 3: Security Engineering
What is the primary purpose of using one-way hashing on user passwords?
pag.474- AIt minimizes the amount of primary and secondary storage needed to store passwords.
- BIt prevents anyone from reading passwords in plaintext.
- CIt avoids excessive processing required by an asymmetric algorithm.
- DIt prevents replay attacks.
67Chapter 3: Security Engineering
Which of the following describes the difference between the Data Encryption Standard and the Rivest-Shamir-Adleman algorithm?
pag.474- ADES is symmetric, while RSA is asymmetric.
- BDES is asymmetric, while RSA is symmetric.
- CThey are hashing algorithms, but RSA produces a 160-bit hashing value.
- DDES creates public and private keys, while RSA encrypts messages.
68Chapter 3: Security Engineering
Which of the following uses a symmetric key and a hashing algorithm?
pag.474- AHMAC
- BTriple-DES
- CISAKMP-OAKLEY
- DRSA
69Chapter 3: Security Engineering
The generation of keys that are made up of random values is referred to as Key
Derivation Functions (KDFs). What values are not commonly used in this key generation process?
Pag.474- AHashing values
- BAsymmetric values
- CSalts
- DPasswords
70Chapter 3: Security Engineering
Which of the following is not a main component of CPTED?
pag.475- ANatural access control
- BNatural surveillance
- CTerritorial reinforcement
- DTarget hardening
71Chapter 3: Security Engineering
Which of the following answers contains a category of controls that does not
belong in a physical security program?
pag.475- ADeterrence and delaying
- BResponse and detection
- CAssessment and detection
- DDelaying and lighting
72Chapter 4: Communication and Network Security
How does TKIP provide more protection for WLAN environments?
pag.715- AIt uses the AES algorithm.
- BIt decreases the IV size and uses the AES algorithm.
- CIt adds more keying material.
- DIt uses MAC and IP filtering.
73Chapter 4: Communication and Network Security
Which of the following is not a characteristic of the IEEE 802.11a standard?
pag.715- AIt works in the 5-GHz range.
- BIt uses the OFDM spread spectrum technology.
- CIt provides 52 Mbps in bandwidth.
- DIt covers a smaller distance than 802.11b.
74Chapter 4: Communication and Network Security
Why are switched infrastructures safer environments than routed networks?
pag.716- AIt is more difficult to sniff traffic since the computers have virtual private
connections. - BThey are just as unsafe as nonswitched environments
- CThe data link encryption does not permit wiretapping.
- DSwitches are more intelligent than bridges and implement security
mechanisms.
- AIt is more difficult to sniff traffic since the computers have virtual private
75Chapter 4: Communication and Network Security
Which of the following protocols is considered connection-oriented?
pag.716- AIP
- BICMP
- CUDP
- DTCP
76Chapter 4: Communication and Network Security
Which of the following can take place if an attacker can insert tagging values into
network- and switch-based protocols with the goal of manipulating traffic at the
data link layer?
Pag.716- AOpen relay manipulation
- BVLAN hopping attack
- CHypervisor denial-of-service attack
- DSmurf attack
77Chapter 4: Communication and Network Security
Which of the following is a bridge-mode technology that can monitor individual
traffic links between virtual machines or can be integrated within a hypervisor
component?
pag.716- AOrthogonal frequency division
- BUnified threat management modem
- CVirtual firewall
- DInternet Security Association and Key Management Protocol
78Chapter 4: Communication and Network Security
Which of the following technologies integrates previously independent security
solutions with the goal of providing simplicity, centralized control, and
streamlined processes?
pag.716- ANetwork convergence
- BSecurity as a service
- CUnified threat management
- DIntegrated convergence management
79Chapter 4: Communication and Network Security
Metro Ethernet is a MAN protocol that can work in network infrastructures made up of access, aggregation, metro, and core layers.
¿Which of the following best describes these network infrastructure layers?
pag.716- AThe access layer connects the customer’s equipment to a service provider’s aggregation network. Aggregation occurs on a core network. The metro layer is the metropolitan area network. The core connects different metro networks.
- BThe access layer connects the customer’s equipment to a service provider’s core network. Aggregation occurs on a distribution network at the core. The metro layer is the metropolitan area network
- CThe access layer connects the customer’s equipment to a service provider’s
aggregation network. Aggregation occurs on a distribution network. The metro layer is the metropolitan area network. The core connects different access layers. - DThe access layer connects the customer’s equipment to a service provider’s
aggregation network. Aggregation occurs on a distribution network. The metro layer is the metropolitan area network. The core connects different metro networks
80Chapter 4: Communication and Network Security
Which of the following provides an incorrect definition of the specific component or protocol that makes up IPSec?
pag.717- AAuthentication Header protocol provides data integrity, data origin authentication, and protection from replay attacks
- BEncapsulating Security Payload protocol provides confidentiality, data origin authentication, and data integrity.
- CInternet Security Association and Key Management Protocol provides a framework for security association creation and key exchange.
- DInternet Key Exchange provides authenticated keying material for use with encryption algorithms
81Chapter 4: Communication and Network Security
Systems that are built on the OSI framework are considered open systems. What does this mean?
pag.717- AThey do not have authentication mechanisms configured by default.
- BThey have interoperability issues.
- CThey are built with internationally accepted protocols and standards so they can easily communicate with other systems.
- DThey are built with international protocols and standards so they can choose what types of systems they will communicate with.
82Chapter 4: Communication and Network Security
Which of the following protocols work in the following layers: application, data
link, network, and transport?
pag.717- AFTP, ARP, TCP, and UDP
- BFTP, ICMP, IP, and UDP
- CTFTP, ARP, IP, and UDP
- DTFTP, RARP, IP, and ICMP
83Chapter 4: Communication and Network Security
Which best describes the IP protocol?
pag.717- AA connectionless protocol that deals with dialog establishment, maintenance,
and destruction - BA connectionless protocol that deals with the addressing and routing of
packets - CA connection-oriented protocol that deals with the addressing and routing of
packets - DA connection-oriented protocol that deals with sequencing, error detection,
and flow control
- AA connectionless protocol that deals with dialog establishment, maintenance,
84Chapter 4: Communication and Network Security
Which of the following is not a characteristic of the Protected Extensible
Authentication Protocol?
pag.717- AAuthentication protocol used in wireless networks and point-to-point connections
- BDesigned to provide authentication for 802.11 WLANs
- CDesigned to support 802.1X port access control and Transport Layer Security
- DDesigned to support password-protected connections
85Chapter 4: Communication and Network Security
The ______________ is an IETF-defined signaling protocol, widely used for
controlling multimedia communication sessions such as voice and video calls over IP.
pag.717- ASession Initiation Protocol
- BReal-time Transport Protocol
- CSS7
- DVoIP
86Chapter 4: Communication and Network Security.
Which of the following is not one of the stages of the DHCP lease process?
i. Discover
ii. Offer
iii. Request
iv. Acknowledgment
pag.718- AAll of them
- BNone of them
- Ci, ii
- Dii, iii
87Chapter 4: Communication and Network Security.
An effective method to shield networks from unauthenticated DHCP clients is
through the use of _______________ on network switches.
pag.718- ADHCP snooping
- BDHCP protection
- CDHCP shielding
- DDHCP caching
88Chapter 5: Identity and Access Management
Which of the following statements correctly describes biometric methods?
pag.854- AThey are the least expensive and provide the most protection.
- BThey are the most expensive and provide the least protection.
- CThey are the least expensive and provide the least protection.
- DThey are the most expensive and provide the most protection.
89Chapter 5: Identity and Access Management
How is a challenge/response protocol utilized with token device implementations?
pag.854- AThis protocol is not used; cryptography is used.
- BAn authentication service generates a challenge, and the smart token generates
a response based on the challenge. - CThe token challenges the user for a username and password.
- DThe token challenges the user’s password against a database of stored
credentials.
90Chapter 5: Identity and Access Management
In discretionary access control security, who has delegation authority to grant access to data?
pag.854- AUser
- BSecurity officer
- CSecurity policy
- DOwner
91Chapter 5: Identity and Access Management
Which of the following is the best description of directories that are used in identity management technology?
pag.855- AMost are hierarchical and follow the X.500 standard.
- BMost have a flat architecture and follow the X.400 standard.
- CMost have moved away from LDAP.
- DMany use LDAP.
92Chapter 5: Identity and Access Management
Which of the following is not considered an anomaly-based intrusion protection
system?
pag.854- AStatistical anomaly–based
- BProtocol anomaly–based
- CTemporal anomaly–based
- DTraffic anomaly–based
93Chapter 5: Identity and Access Management
Which of the following has the correct term-to-definition mapping?
i. Brute-force attacks: Performed with tools that cycle through many possible character, number, and symbol combinations to uncover a password.
ii. Dictionary attacks: Files of thousands of words are compared to the user’s password until a match is found.
iii. Social engineering: An attacker falsely convinces an individual that she has the necessary authorization to access specific resources.
iv. Rainbow table: An attacker uses a table that contains all possible passwords already in a hash format.
pag.856- Ai, ii
- Bi, ii, iv
- Ci, ii, iii, iv
- Di, ii, iii
94Chapter 6: Security Assessment and Testing
Internal audits are the preferred approach when which of the following is true?
pag.919- AThe organization lacks the organic expertise to conduct them.
- BRegulatory requirements dictate the use of a third-party auditor.
- CThe budget for security testing is limited or nonexistent.
- DThere is concern over the spillage of proprietary or confidential information.
95Chapter 6: Security Assessment and Testing
All of the following are steps in the security audit process except which one?
pag.919- ADocument the results.
- BConvene a management review.
- CInvolve the right business unit leaders.
- DDetermine the scope.
96Chapter 6: Security Assessment and Testing
Which of the following is an advantage of using third-party auditors?
pag.919- AThey may have knowledge that an organization wouldn’t otherwise be able to
leverage - BTheir cost.
- CThe requirement for NDAs and supervision.
- DTheir use of automated scanners and reports.
- AThey may have knowledge that an organization wouldn’t otherwise be able to
97Chapter 6: Security Assessment and Testing
An assessment whose goal is to assess the susceptibility of an organization to social engineering attacks is best classified as..
pag.919- APhysical testing
- BPersonnel testing
- CVulnerability testing
- DNetwork testing
98Chapter 6: Security Assessment and Testing
Vulnerability scans normally involve all of the following except which one?
pag.919- AThe identification of active hosts on the network
- BThe identification of malware on all hosts
- CThe identification of misconfigured settings
- DThe identification of operating systems
99Chapter 6: Security Assessment and Testing
Synthetic transactions are best described as..
pag.919- AReal user monitoring (RUM)
- BTransactions that fall outside the normal purpose of a system
- CTransactions that are synthesized from multiple users’ interactions with the system
- DA way to test the behavior and performance of critical services
100Chapter 6: Security Assessment and Testing
One of the actions that attackers typically attempt after compromising a system is to acquire the ability to mimic a normal privileged user. What is one way in which they may accomplish this?
pag.920- ARebooting the compromised host
- BExporting the password hash table
- CPivoting from the compromised host to another target
- DAdding a privileged user account
101Chapter 6: Security Assessment and Testing
Which of the following is not normally an element of user accounts management audits?
pag.920- APassword hashing
- BSigned AUPs
- CPrivileged accounts
- DSuspended accounts
102Chapter 6: Security Assessment and Testing
How might one test adherence to the user accounts policy?
pag.920- AUser self-reporting
- BPenetration testing
- CManagement review
- DUser records auditing
103Chapter 6: Security Assessment and Testing
Which operating systems allows users to temporarily elevate their privileges in order to launch an application at a higher privilege level?
pag.920- AAll major desktop operating systems
- BRecent versions of Windows
- CLinux and Windows
- DRecent versions of Mac OS X
104Chapter 6: Security Assessment and Testing
Why would an organization need to periodically test disaster recovery and business continuity plans if they’ve already been shown to work?
pag.920- AEnvironmental changes may render them ineffective over time.
- BIt has low confidence in the abilities of the testers.
- CTo appease senior leadership.
- DResources may not be available in the future to test again.
105Chapter 6: Security Assessment and Testing
All of the following are types of tests for disaster recovery and business continuity plans except which one?
pag.920- AStructured walk-through test
- BSimulation test
- CNull hypothesis test
- DFull-interruption test
106Chapter 6: Security Assessment and Testing
What is the difference between security training and security awareness training?
pag.920- ASecurity training is focused on skills, while security awareness training is focused on recognizing and responding to issues.
- BSecurity training must be performed, while security awareness training is an aspirational goal.
- CSecurity awareness training is focused on security personnel, while security
training is geared toward all users. - DThere is no difference. These terms refer to the same process.
107Chapter 6: Security Assessment and Testing
What is a key performance indicator (KPI)?
pag.920- AAny attribute of the ISMS that can be described as a value
- BThe value of a factor at a particular point in time
- CA derived value that is generated by comparing multiple measurements against each other or against a baseline
- DAn interpretation of one or more metrics that describes the effectiveness of the ISMS
108Chapter 6: Security Assessment and Testing
Which of the following is true about key risk indicators (KRIs)?
pag.921- AThey tell managers where an organization stands with regard to its goals.
- BThey are inputs to the calculation of single loss expectancy (SLE).
- CThey tell managers where an organization stands with regard to its risk appetite.
- DAn interpretation of one or more metrics that describes the effectiveness of the ISMS.
109Chapter 6: Security Assessment and Testing
Which of the following is true of management reviews?
pag.921- AThey happen periodically and include results of audits as a key input.
- BThey happen in an ad hoc manner as the needs of the organization dictate.
- CThey are normally conducted by mid-level managers, but their reports are
presented to the key business leaders. - DThey are focused on assessing the management of the information systems.
110Chapter 7: Security Operations
What is the difference between due care and due diligence?
pag.1072- ADue care is the continual effort to ensure that the right thing takes place, and due diligence is the continual effort to stay compliant with regulations.
- BDue care is based on the prudent person concept, whereas due diligence is not.
- CThey mean the same thing.
- DDue diligence involves investigating the risks, whereas due care involves carrying out the necessary steps to mitigate these risks.
111Chapter 7: Security Operations
Which of the following best describes separation of duties and job rotation?
pag.1072- ASeparation of duties ensures that more than one employee knows how to perform the tasks of a position, and job rotation ensures that one person cannot perform a high-risk task alone.
- BSeparation of duties ensures that one person cannot perform a high-risk task alone, and job rotation can uncover fraud and ensure that more than one person knows the tasks of a position.
- CThey are the same thing, but with different titles.
- DThey are administrative controls that enforce access control and protect the
company’s resources.
112Chapter 7: Security Operations
Why is it important to control and audit input and output values?
pag.1073- AIncorrect values can cause mistakes in data processing and be evidence
of fraud. - BIncorrect values can be the fault of the programmer and do not comply with
the due care clause. - CIncorrect values can be caused by brute-force attacks.
- DIncorrect values are not security issues.
- AIncorrect values can cause mistakes in data processing and be evidence
113Chapter 7: Security Operations
What is the difference between least privilege and need to know?
pag.1073- AA user should have least privilege that restricts her need to know.
- BA user should have a security clearance to access resources, a need to know about those resources, and least privilege to give her full control of all resources.
- CA user should have a need to know to access particular resources, and least privilege should be implemented to ensure she only accesses the resources she has a need to know.
- DThey are two different terms for the same issue.
114Chapter 7: Security Operations
A company needs to implement a CCTV system that will monitor a large area outside the facility. Which of the following is the correct lens combination for this?
pag.1073- AA wide-angle lens and a small lens opening
- BA wide-angle lens and a large lens opening
- CA wide-angle lens and a large lens opening with a small focal length
- DA wide-angle lens and a large lens opening with a large focal length
115Chapter 7: Security Operations
What is true about a transponder?
pag.1073- AIt is a card that can be read without sliding it through a card reader.
- BIt is a biometric proximity device.
- CIt is a card that a user swipes through a card reader to gain access to a facility.
- DIt exchanges tokens with an authentication server.
116Chapter 7: Security Operations
When is a security guard the best choice for a physical access control mechanism?
pag.1073- AWhen discriminating judgment is required
- BWhen intrusion detection is required
- CWhen the security budget is low
- DWhen access controls are in place
117Chapter 7: Security Operations
Which of the following is not a characteristic of an electrostatic intrusion detection system?
pag.1074- AIt creates an electrostatic field and monitors for a capacitance change.
- BIt can be used as an intrusion detection system for large areas.
- CIt produces a balance between the electric capacitance and inductance of
an object. - DIt can detect if an intruder comes within a certain range of an object.
118Chapter 7: Security Operations
What is a common problem with vibration-detection devices used for perimeter security?
pag.1074- AThey can be defeated by emitting the right electrical signals in the protected area.
- BThe power source is easily disabled.
- CThey cause false alarms
- DThey interfere with computing devices.
119Chapter 7: Security Operations
Which of the following is not considered a delaying mechanism?
pag.1074- ALocks
- BDefense-in-depth measures
- CWarning signs
- DAccess controls
120Chapter 7: Security Operations
What are the two general types of proximity identification devices?
pag.1074- ABiometric devices and access control devices
- BSwipe card devices and passive devices
- CPreset code devices and wireless devices
- DUser-activated devices and system sensing devices
121Chapter 7: Security Operations
What is a cipher lock?
pag.1074- AA lock that uses cryptographic keys
- BA lock that uses a type of key that cannot be reproduced
- CA lock that uses a token and perimeter reader
- DA lock that uses a keypad
122Chapter 7: Security Operations
If a cipher lock has a door delay option, what does that mean?
pag.1078- AAfter a door is open for a specific period, the alarm goes off.
- BIt can only be opened during emergency situations.
- CIt has a hostage alarm capability.
- DIt has supervisory override capability.
123Chapter 7: Security Operations
You come across an advanced piece of polymorphic malware that uses a custom communications protocol for network traffic. This protocol has a distinctive signature in its header. Which tool is best suited to mitigate this malware by preventing the packets from traversing the network?
pag.1074- AAntimalware
- BStateful firewall
- CIntrusion detection system (IDS)
- DIntrusion prevention system (IPS)
124Chapter 7: Security Operations
Which of the following is something that should be required of an offsite backup facility that stores backed-up media for companies?
pag.1075- AThe facility should be within 10 to 15 minutes of the original facility to ensure easy access.
- Bhe facility should contain all necessary PCs and servers and should have raised flooring.
- CThe facility should be protected by an armed guard.
- DThe facility should protect against unauthorized access and entry.
125Chapter 7: Security Operations
After a computer forensic investigator seizes a computer during a crime investigation, what is the next step?
pag.1075- ALabel and put it into a container, and then label the container
- BDust the evidence for fingerprints
- CMake an image copy of the disks
- DLock the evidence in the safe
Information
- Description
- Quiz on CISSP, created by capufe c on 14/05/2018.
- Author
- capufe c
- Language
- Español
- Views
- 33
- Rating
- No ratings yet Rate this quiz