Kopieren und bearbeiten

CISSP Official Study Guide Questions (19-21)

Beschreibung

CISSP Information Security Quiz am CISSP Official Study Guide Questions (19-21), erstellt von Allison Mernka am 14/12/2021.
Allison Mernka
Erzeugt von Allison Mernka
Allison Mernka
Erstellt von Allison Mernka vor fast 5 Jahre
29
1
0

Zusammenfassung der Ressource

Frage 1

Frage
What is a computer crime?
Antworten
  • Any attack specifically listed in your security policy
  • Any illegal attack that compromises a protected computer
  • Any violation of a law or regulation that involves a computer
  • Failure to practice due diligence in computer security

Frage 2

Frage
What is the main purpose of a military and intelligence attack?
Antworten
  • To attack the availability of military systems
  • To obtain secret and restricted information from military or law enforcement sources
  • To utilize military or intelligence agency systems to attack other nonmilitary sites
  • To compromise military systems for use in attacks against other systems

Frage 3

Frage
What type of attack targets proprietary information stored on a civilian organization's system.
Antworten
  • Business attack
  • Denial of service attack
  • Financial attack
  • Military and intelligence attack

Frage 4

Frage
What goal is not a purpose of a financial attack?
Antworten
  • Access services you have not purchased
  • Disclose confidential personal employee information
  • Transfer funds from an unapproved source into your account
  • Steal money from another organization

Frage 5

Frage
Which one of the following attacks is most indicative of a terrorist attack?
Antworten
  • Altering sensitive trade secret documents
  • Damaging the ability to communicate and respond to a physical attack
  • Stealing unclassified information
  • Transferring funds to other countries

Frage 6

Frage
Which of the following would not be a primary goal of a grudge attack?
Antworten
  • Disclosing embarrassing personal information
  • Launching a virus on an organization's system
  • Sending inappropriate email with a spoofed origination address of the victim organization
  • Using automated tools to scan the organization's systems for vulnerable ports

Frage 7

Frage
What are the primary reasons attackers engage in thrill attacks? (Choose all that apply)
Antworten
  • Bragging rights
  • Money from the sale of stolen documents
  • Pride of conquering a secure system
  • Retaliation against a person or organization

Frage 8

Frage
What is the most important rule to follow when collecting evidence?
Antworten
  • Do not turn off a computer until you photograph the screen
  • List all people present while collecting evidence
  • Never modify evidence during the collection process
  • Transfer all equipment to a secure storage location

Frage 9

Frage
What would be a valid argument for not immediately removing power from a machine when an incident is disovered?
Antworten
  • All of the damage has been done. Turning the machine off would not stop additional damage.
  • There is no other system that can replace this one if it is turned off.
  • Too many users are logged in and using the system.
  • Valuable evidence in memory will be lost.

Frage 10

Frage
Hacktivists are motivated by which of the following factors? (Choose all that apply)
Antworten
  • Financial gain
  • Thrill
  • Skill
  • Political beliefs

Frage 11

Frage
Which one of the following investigation types has the highest standard of evidence?
Antworten
  • Administrative
  • Civil
  • Criminal
  • Regulatory

Frage 12

Frage
During an operational investigation, what type of analysis might an organization undertake to prevent similar incidents in the future?
Antworten
  • Forensic analysis
  • Root-cause analysis
  • Network traffic analysis
  • Fagan analysis

Frage 13

Frage
What step of the Electronic Discovery Reference Model ensures that information that may be subject to discovery is not altered?
Antworten
  • Preservation
  • Production
  • Processing
  • Presentation

Frage 14

Frage
Gary is a system administrator and is testifying in court about a cybercrime incident. He brings server logs to support his testimony. What type of evidence are the server logs?
Antworten
  • Real evidence
  • Documentary evidence
  • Parol evidence
  • Testimonial evidence

Frage 15

Frage
If you need to confiscate a PC from a suspected attacker who does not work for your organization, what legal avenue is most appropriate?
Antworten
  • Consent agreement signed by employees.
  • Search warrant.
  • No legal avenue is necessary.
  • Voluntary consent.

Frage 16

Frage
Why should you avoid deleting log files on a daily basis?
Antworten
  • An incident may not be discovered for several days and valuable evidence could be lost.
  • Disk space is cheap, and log files are used frequently.
  • Log files are protected and cannot be altered.
  • Any information in a log file is useless after it is several hours old.

Frage 17

Frage
What phase of the Electronic Discovery Reference Model examines information to remove information subject to attorney-client privilege?
Antworten
  • Identification
  • Collection
  • Processing
  • Review

Frage 18

Frage
What are ethics?
Antworten
  • Mandatory actions required to fulfill job requirements
  • Laws of professional conduct
  • Regulations set forth by a professional organization
  • Rules of personal behavior

Frage 19

Frage
According to the (ISC)2 Code of Ethics, how are CISSPs expected to act?
Antworten
  • Honestly, diligently, responsibly, and legally
  • Honorably, honestly, justly, responsibly, and legally
  • Upholding the security policy and protecting the organization
  • Trustworthy, loyally, friendly, courteously

Frage 20

Frage
Which of the following actions are considered unacceptable and unethical according to RFC 1087, "Ethics and the Internet"?
Antworten
  • Actions that compromise the privacy of classified information
  • Actions that compromise the privacy of users
  • Actions that disrupt organizational activities
  • Actions in which a computer is used in a manner inconsistent with a stated security policy

Frage 21

Frage
Which one of the following is not a component of the DevOps model?
Antworten
  • Information security
  • Software development
  • Quality assurance
  • IT operations

Frage 22

Frage
Bob is developing a software application and has a field where users may enter a date. He wants to ensure that the values provided by the users are accurate dates to prevent security issues. What technique should Bob use?
Antworten
  • Polyinstantiation
  • Input validation
  • Contamination
  • Screening

Frage 23

Frage
What portion of the change management process allows developers to prioritize tasks?
Antworten
  • Release control
  • Configuration control
  • Request control
  • Change audit

Frage 24

Frage
What approach to failure management places the system in a high level of security?
Antworten
  • Fail-open
  • Fail mitigation
  • Fail-secure
  • Fail clear

Frage 25

Frage
What software development model uses a seven stage approach with a feedback loop that allows progress one step backward?
Antworten
  • Boyce-Codd
  • Waterfall
  • Spiral
  • Agile

Frage 26

Frage
What form of access control is concerned primarily with the data stored by a field?
Antworten
  • Content dependent
  • Context dependent
  • Semantic integrity mechanisms
  • Perturbation

Frage 27

Frage
Which one of the following key types is used to enforce referential integrity between database tables?
Antworten
  • Candidate key
  • Primary key
  • Foreign key
  • Super key

Frage 28

Frage
Richard believes that a database user is misusing his privileges to gain informaiton about the company's overall business trends by issuing queries that combine data from a large number of records. What process is the database user taking advantage of?
Antworten
  • Inference
  • Contamination
  • Polyinstantiation
  • Aggregation

Frage 29

Frage
What database technique can be used to prevent unauthorized users from determining classified information by noticing the absence of information normally available to them?
Antworten
  • Inference
  • Manipulation
  • Polyinstantiation
  • Aggregation

Frage 30

Frage
Which one of the following is not a principle of Agile development?
Antworten
  • Satisfy the customer through early and continuous delivery
  • Business people and developers work together
  • Pay continuous attention to technical excellence
  • Prioritize security over other requirements

Frage 31

Frage
What type of information is used to form the basis of an expert system's decision making process?
Antworten
  • A series of weighted layered computations
  • Combined input from a number of human experts, weighted according to past performance
  • A series of "if/then" rules codified in a knowledge base
  • A biological decision making process that simulates the reasoning process used by the human mind

Frage 32

Frage
In which pase of the SW-CMM does an organization use quantitative measures to gain a detailed understanding of the development process?
Antworten
  • Initial
  • Repeatable
  • Defined
  • Managed

Frage 33

Frage
Which of the following acts as a proxy between an application and a database to support interaction and simplify the work of programmers?
Antworten
  • SDLC
  • ODBC
  • DSS
  • Abstraction

Frage 34

Frage
In what type of software testing does the tester have access to the underlying source code?
Antworten
  • Static testing
  • Dynamic testing
  • Cross site scripting testing
  • Black box testing

Frage 35

Frage
What type of chart provides a graphical illustration of a schedule that helps to plan, coordinate, and track project tasks?
Antworten
  • Gantt
  • Venn
  • Bar
  • PERT

Frage 36

Frage
Which database security risk occurs when data from a higher classification level is mixed with data from a lower classification level?
Antworten
  • Aggregation
  • Inference
  • Contamination
  • Polyinstantiation

Frage 37

Frage
What database security technology involves creating two or more rows with seemingly identical primary keys that contain different data for users with different security clearances?
Antworten
  • Polyinstantiation
  • Cell suppression
  • Aggregation
  • Views

Frage 38

Frage
Which one of the following is not part of the change management process?
Antworten
  • Request control
  • Release control
  • Configuration audit
  • Change control

Frage 39

Frage
What transaction management principle ensures that two transactions do not interfere with each other as they operate on the same data?
Antworten
  • Atomicity
  • Consistency
  • Isolation
  • Durability

Frage 40

Frage
Tom built a database table consisting of the names, telephone numbers, and customer IDs for his business. The table contains information on 30 customers. What is the degree of this table?
Antworten
  • Two
  • Three
  • Thirty
  • Undefined

Frage 41

Frage
What is the most commonly used technique to protect against virus attacks?
Antworten
  • Signature detection
  • Heuristic detection
  • Data integrity assurance
  • Automated reconstruction

Frage 42

Frage
You are the security administrator for an e-commerce company and are placing a new web server into production. What network zone should you use?
Antworten
  • Internet
  • DMZ
  • Intranet
  • Sandbox

Frage 43

Frage
Which one of the following types of attacks relies on the difference between the timing of two events?
Antworten
  • Smurf
  • TOCTTOU
  • Land
  • Fraggle

Frage 44

Frage
Which one of the following techniques is most closely associated with APT attacks?
Antworten
  • Zero-day exploit
  • Social engineering
  • Trojan horse
  • SQL injection

Frage 45

Frage
What advanced virus technique modifies the malicious code of a virus on each system it infects?
Antworten
  • Polymorphism
  • Stealth
  • Encryption
  • Multipartitism

Frage 46

Frage
Which one of the following tools provides a solution to the problem of users forgetting complex passwords?
Antworten
  • LastPass
  • Crack
  • Shadow password files
  • Tripwire

Frage 47

Frage
What type of application vulnerability most directly allows an attacker to modify the contents of a system's memory?
Antworten
  • Rootkit
  • Back door
  • TOC/TOU
  • Buffer overflow

Frage 48

Frage
Which one of the following passwords is least likely to be compromised during a dictionary attack?
Antworten
  • mike
  • elppa
  • dayorange
  • fsas3a1G

Frage 49

Frage
What technique may be used to limit the effectiveness of rainbow table attacks?
Antworten
  • hashing
  • salting
  • digital signatures
  • transport encryption

Frage 50

Frage
What character should always be treated carefully when encountered as user input on a web form?
Antworten
  • !
  • &
  • *
  • '

Frage 51

Frage
What database technology, if implemented for web forms, can limit the potential for SQL injection attacks?
Antworten
  • Triggers
  • Stored procedures
  • Column encryption
  • Concurrency control

Frage 52

Frage
What type of reconnaissance attack provides attackers with useful information about the services running on a system?
Antworten
  • Sesison hijacking
  • Port scan
  • Dumpster diving
  • IP sweep

Frage 53

Frage
What condition is necessary on a web page for it to be used in a cros-site scripting attack?
Antworten
  • Reflected input
  • Database driven content
  • .NET technology
  • CGI scripts

Frage 54

Frage
What type of virus utilizes more than one propagation techniqe to maximize the number of penetrated systems?
Antworten
  • Stealth virus
  • Companion virus
  • Polymorphic virus
  • Mulipartite virus

Frage 55

Frage
What is the most effective defense against cross-site scripting attacks?
Antworten
  • Limiting account privileges?
  • Input validation
  • User authentication
  • Encryption

Frage 56

Frage
What worm was the first to cause major physical damage to a facility?
Antworten
  • Stuxnet
  • Code Red
  • Melissa
  • RTM

Frage 57

Frage
Ben's system was infected by malicious code that modified the operating system to allow the malicious code author to gain access to his files. What type of exploit did this attacker engage in?
Antworten
  • Escalation of privilege
  • Back door
  • Rootkit
  • Buffer overflow

Frage 58

Frage
What technology does the Java language use to minimize the threat posed by applets?
Antworten
  • Confidentiality
  • Encryption
  • Stealth
  • Sandbox

Frage 59

Frage
What HTML tag is often used as part of a cross site scripting (XSS) attack?
Antworten
  • <HI>
  • <HEAD>
  • <XSS>
  • <SCRIPT>

Frage 60

Frage
When designing firewall rules to prevent IP spoofing, which of the following principles should you follow?
Antworten
  • Packets with internal source IP addresses don't enter the network from the outside
  • Packets with internal source IP addresses don't exit the network from the inside
  • Packets with public IP addresses don't pass through the router in either direction
  • Packets with external source IP addresses don't enter the network from the outside
Zusammenfassung anzeigen Zusammenfassung ausblenden

Möchten Sie mit GoConqr kostenlos Ihre eigenen Quiz erstellen? eigenen Mehr erfahren.

ähnlicher Inhalt

Infosec Basics
bondarets
2.1 Business Influences and Associated Security Risks
DJ Perrone
Types of Attacks
River L.
Information Security: Chapter 2
marcb176
Data-centric Security
Michael Mihalik
Threats
marnus.db
Information Security FULL WORK
Luis Mauricio Falla Guiulfo
Bibliothek durchsuchen