CISSP Official Study Guide Questions (19-21)

What is a computer crime?

What is the main purpose of a military and intelligence attack?

What type of attack targets proprietary information stored on a civilian organization's system.

What goal is not a purpose of a financial attack?

Which one of the following attacks is most indicative of a terrorist attack?

Which of the following would not be a primary goal of a grudge attack?

What is the most important rule to follow when collecting evidence?

What would be a valid argument for not immediately removing power from a machine when an incident is disovered?

Which one of the following investigation types has the highest standard of evidence?

During an operational investigation, what type of analysis might an organization undertake to prevent similar incidents in the future?

What step of the Electronic Discovery Reference Model ensures that information that may be subject to discovery is not altered?

Gary is a system administrator and is testifying in court about a cybercrime incident. He brings server logs to support his testimony. What type of evidence are the server logs?

If you need to confiscate a PC from a suspected attacker who does not work for your organization, what legal avenue is most appropriate?

Why should you avoid deleting log files on a daily basis?

What phase of the Electronic Discovery Reference Model examines information to remove information subject to attorney-client privilege?

What are ethics?

According to the (ISC)2 Code of Ethics, how are CISSPs expected to act?

Which of the following actions are considered unacceptable and unethical according to RFC 1087, "Ethics and the Internet"?

Which one of the following is not a component of the DevOps model?

Bob is developing a software application and has a field where users may enter a date. He wants to ensure that the values provided by the users are accurate dates to prevent security issues. What technique should Bob use?

What portion of the change management process allows developers to prioritize tasks?

What approach to failure management places the system in a high level of security?

What software development model uses a seven stage approach with a feedback loop that allows progress one step backward?

What form of access control is concerned primarily with the data stored by a field?

Which one of the following key types is used to enforce referential integrity between database tables?

Richard believes that a database user is misusing his privileges to gain informaiton about the company's overall business trends by issuing queries that combine data from a large number of records. What process is the database user taking advantage of?

What database technique can be used to prevent unauthorized users from determining classified information by noticing the absence of information normally available to them?

Which one of the following is not a principle of Agile development?

What type of information is used to form the basis of an expert system's decision making process?

In which pase of the SW-CMM does an organization use quantitative measures to gain a detailed understanding of the development process?

Which of the following acts as a proxy between an application and a database to support interaction and simplify the work of programmers?

In what type of software testing does the tester have access to the underlying source code?

What type of chart provides a graphical illustration of a schedule that helps to plan, coordinate, and track project tasks?

Which database security risk occurs when data from a higher classification level is mixed with data from a lower classification level?

What database security technology involves creating two or more rows with seemingly identical primary keys that contain different data for users with different security clearances?

Which one of the following is not part of the change management process?

What transaction management principle ensures that two transactions do not interfere with each other as they operate on the same data?

Tom built a database table consisting of the names, telephone numbers, and customer IDs for his business. The table contains information on 30 customers. What is the degree of this table?

What is the most commonly used technique to protect against virus attacks?

You are the security administrator for an e-commerce company and are placing a new web server into production. What network zone should you use?

Which one of the following types of attacks relies on the difference between the timing of two events?

Which one of the following techniques is most closely associated with APT attacks?

What advanced virus technique modifies the malicious code of a virus on each system it infects?

Which one of the following tools provides a solution to the problem of users forgetting complex passwords?

What type of application vulnerability most directly allows an attacker to modify the contents of a system's memory?

Which one of the following passwords is least likely to be compromised during a dictionary attack?

What technique may be used to limit the effectiveness of rainbow table attacks?

What character should always be treated carefully when encountered as user input on a web form?

What database technology, if implemented for web forms, can limit the potential for SQL injection attacks?

What type of reconnaissance attack provides attackers with useful information about the services running on a system?

What condition is necessary on a web page for it to be used in a cros-site scripting attack?

What type of virus utilizes more than one propagation techniqe to maximize the number of penetrated systems?

What is the most effective defense against cross-site scripting attacks?

What worm was the first to cause major physical damage to a facility?

Ben's system was infected by malicious code that modified the operating system to allow the malicious code author to gain access to his files. What type of exploit did this attacker engage in?

What technology does the Java language use to minimize the threat posed by applets?

What HTML tag is often used as part of a cross site scripting (XSS) attack?

When designing firewall rules to prevent IP spoofing, which of the following principles should you follow?