[Nov 10, 2021] CISSP Sample with Accurate & Updated Questions
CISSP Exam Info and Free Practice Test | ActualTestsQuiz
NEW QUESTION 350
Under MAC, who may grant a right of access that is explicitly forbidden in the access control policy?
- A. Administrators only.
- B. All users.
- C. All managers.
- D. None of the choices.
Answer: D
Explanation:
MAC is defined as follows in the Handbook of Information Security Management: With mandatory controls, only administrators and not owners of resources may make decisions that bear on or derive from policy. Only an administrator may change the category of a resource, and no one may grant a right of access that is explicitly forbidden in the access control policy.
NEW QUESTION 351
Which of the following is the preferred way to suppress an electrical fire in an information center?
- A. CO2, soda acid, or Halon
- B. water or soda acid
- C. CO2
- D. ABC Rated Dry Chemical
Answer: C
Explanation:
It must be noted that Halon is now banned in most countries or cities.
The reason CO2 is preferred in an information center is the agent is considered a clean agent, as
well as non-conductive. The agent evaporates and does not leave a residue on the equipment.
CO2 can be hazardous to people so special care must be taken when implemented.
Water may be a sound solution for large physical areas such as warehouses, but it is entirely
inappropriate for computer equipment. A water spray can irreparably damage hardware more
quickly than encroaching smoke or heat. Gas suppression systems operate to starve the fire of
oxygen. In the past, Halon was the choice for gas suppression systems; however, Halon leaves
residue, depletes the ozone layer, and can injure nearby personnel.
NOTE FROM CLEMENT:
For the purpose of the exam do not go outside of the 4 choices presented. YES, it is true that
there are many other choices that would be more adequate for a Data Centre. An agent such as
IG-55 from Ardent would probably be a better choice than CO2, however it is NOT in the list of
choices.
You will also notice that Shon Harris and Krutz and Vines disagree on which one is the best. This
is why you must do your own research to supplement the books, sometimes books could be
opiniated as well. When in doubt refer to the official book and look at what is ISC2 view of the topic
and which one ISC2 considers to be the best for the exam.
ISC2 recommends also the following:
Aero-K - uses an aerosol of microscopic potassium compounds in a carrier gas released from
small canisters mounted on walls near the ceiling. The Aero-K generators are not pressurized until
fire is detected. The Aero-K system uses multiple fire detectors and will not release until a fire is
"confirmed" by two or more detectors (limiting accidental discharge). The gas is non-corrosive, so
it does not damage metals or other materials. It does not harm electronic devices or media such
as tape or discs. More important, Aero-K is nontoxic and does not injure personnel.
FM-200 - is a colorless, liquefied compressed gas. It is stored as a liquid and dispensed into the
hazard as a colorless, electrically non-conductive vapor that is clear and does not obscure vision.
It leaves no residue and has acceptable toxicity for use in occupied spaces at design
concentration. FM-200 does not displace oxygen and, therefore, is safe for use in occupied
spaces without fear of oxygen deprivation.
The following are incorrect choices:
Water or Soda/Acid & Halon: (old water extinguishers) will damage sensitive equipment as well as
conduct electricity which could endanger the life of the person using such a fire extinghisher.
Halon has been banned due to the Montreal Protocol.
ABC rated Dry chemical extinguishers: They are suitable for electrically energized fires, but they
are not acceptable on sensitive equipment. It is like throwing a couple kilograms of flour in around
in a room. It is extremely hard to clean off of equipment and some of the chemicals are corrosive
in nature.
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition
((ISC)2 Press) (Kindle Locations 25609-25612). Auerbach Publications. Kindle Edition. and http://www.ehs.ucf.edu/labsafe/safemgequip.html or http://www.osha.gov/doc/outreachtraining/htmlfiles/extmark.html
NEW QUESTION 352
Which of the following is used in database information security to hide information?
- A. Polyinstantiation
- B. Inheritance
- C. Delegation
- D. Polymorphism
Answer: A
Explanation:
Explanation/Reference:
Explanation:
Polyinstantiation is a process of interactively producing more detailed versions of objects by populating variables with different values or other variables. It is often used to prevent inference attacks by hiding information.
Incorrect Answers:
A: Inheritance is not used to hide database information. Within object orientation programming inheritance is a mechanism for code reuse and to allow independent extensions of the original software via public classes and interfaces.
C: Polymorphism is when different objects are given the same input and react differently. Polymorphism is not a way to hide database security information.
D: Delegation is a concept within object-oriented programming. Delegation does not concern information security for database.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 1136, 1186
http://en.wikipedia.org/wiki/Polyinstantiation
https://en.wikipedia.org/wiki/Polymorphism_(computer_science)
NEW QUESTION 353
Which of the following protocols does not operate at the data link layer (layer 2)?
- A. ICMP
- B. RARP
- C. PPP
- D. L2F
Answer: A
Explanation:
Internet Control Message Protocol. ICMP is used for diagnostics in the network. The Unix program, ping, uses ICMP messages to detect the status of other hosts in the net. ICMP messages can either be queries (in the case of ping) or error reports, such as when a network is unreachable. This protocol resides in layer 3 of the OSI model
(Network layer).
NEW QUESTION 354
A security analyst for a large financial institution is reviewing network traffic related to an incident. The analyst determines the traffic is irrelevant to the investigation but in the process of the review, the analyst also finds that an applications data, which included full credit card cardholder data, is transferred in clear text between the server and user's desktop. The analyst knows this violates the Payment Card Industry Data Security Standard (PCI-DSS). Which of the following is the analyst's next step?
- A. Send the log file co-workers for peer review
- B. Ignore data as it is outside the scope of the investigation and the analyst's role.
- C. Include the full network traffic logs in the incident report
- D. Follow organizational processes to alert the proper teams to address the issue.
Answer: D
NEW QUESTION 355
Which of the following is a process in the access provisioning lifecycle that will MOST likely identify access aggregation issues?
- A. Review
- B. Test
- C. Assessment
- D. Peer review
Answer: A
Explanation:
Reference: https://books.google.com.pk/books?id=W2TvAgAAQBAJ pg=PA256&lpg=PA256& dq=process+in+the+access+provisioning+lifecycle+that+will+MOST+likely+identify+access+aggregation+
&source=bl&ots=OBJo9fbGP3 sig=ACfU3U1eAWDu3q4EoiusrOi_hvtu6WyaIg&hl=en&sa=X& ved=2ahUKEwiu-Mac0anpAhXIxIUKHQi2BFsQ6AEwAXoECBAQAQ#v=onepage& q=process%20in%20the%20access%20provisioning%20lifecycle%20that%20will%20MOST%20likely%
&f=false
NEW QUESTION 356
Which choice below is NOT an accurate description of an information
policy?
- A. Information policy is a documentation of computer security
decisions. - B. Information policy is senior management's directive to create a
computer security program. - C. An information policy could be a decision pertaining to use of the
organization's fax. - D. Information policies are created after the system's infrastructure has been designed and built.
Answer: D
Explanation:
Computer security policy is often defined as the documentation
of computer security decisions. The term policy has more than
one meaning. Policy is senior management's directives to create a
computer security program, establish its goals, and assign
responsibilities. The term policy is also used to refer to the specific security rules for particular systems. Additionally, policy may refer to entirely different matters, such as the specific managerial decisions setting an organization's e-mail privacy policy or fax
security policy.
A security policy is an important document to develop while
designing an information system, early in the System Development
Life Cycle (SDLC). The security policy begins with the organization's
basic commitment to information security formulated as a general
policy statement. The policy is then applied to all aspects of the
system design or security solution. Source: NIST Special Publication
800-27, Engineering Principles for Information Technology Security (A
Baseline for Achieving Security).
NEW QUESTION 357
Which of the following groups represents the leading source of computer crime losses?
- A. Employees
- B. Industrial saboteurs
- C. Foreign intelligence officers
- D. Hackers
Answer: A
Explanation:
There are some conflicting figures as to which group is a bigger threat hackers or employees. Employees are still considered to the leading source of computer crime losses. Employees often have an easier time gaining access to systems or source code then ousiders or other means of creating computer crimes. A word of caution is necessary: although the media has tended to portray the threat of cybercrime as existing almost exclusively from the outside, external to a company, reality paints a much different picture. Often the greatest risk of cybercrime comes from the inside, namely, criminal insiders. Information security professionals must be particularly sensitive to the phenomena of the criminal or dangerous insider, as these individuals usually operate under the radar, inside of the primarily outward/external facing security controls, thus significantly increasing the impact of their crimes while leaving few, if any, audit trails to follow and evidence for prosecution. Some of the large scale crimes committed agains bank lately has shown that Internal Threats are the worst and they are more common that one would think. The definition of what a hacker is can vary greatly from one country to another but in some of the states in the USA a hacker is defined as Someone who is using resources in a way that is not authorized. A recent case in Ohio involved an internal employee who was spending most of his day on dating website looking for the love of his life. The employee was taken to court for hacking the company resources.
The following answers are incorrect: hackers. Is incorrect because while hackers represent a very large problem and both the frequency of attacks and overall losses have grown hackers are considered to be a small segment of combined computer fraudsters. industrial saboteurs. Is incorrect because industrial saboteurs tend to go after trade secrets. While the loss to the organization can be great, they still fall short when compared to the losses created by employees. Often it is an employee that was involved in industrial sabotage. foreign intelligence officers. Is incorrect because the losses tend to be national secrets. You really can't put t cost on this and the number of frequency and occurances of this is less than that of employee related losses.
Reference(s) used for this question: Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 22327-22331). Auerbach Publications. Kindle Edition.
NEW QUESTION 358
Controls such as job rotation, the sharing of responsibilities, and reviews of audit records are associated with:
- A. Detective/technical
- B. Detective/administrative
- C. Detective/physical
- D. Preventive/physical
Answer: B
Explanation:
Additional detective/administrative controls are job rotation, the sharing of responsibilities, and reviews of audit records.
Reference(s) used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, 2001, John Wiley & Sons, Page 35
NEW QUESTION 359
Cryptography does NOT help in:
- A. Detecting fraudulent insertion.
- B. Detecting fraudulent disclosure.
- C. Detecting fraudulent deletion.
- D. Detecting fraudulent modification.
Answer: B
Explanation:
Cryptography is a detective control in the fact that it allows the detection of fraudulent insertion, deletion or modification. It also is a preventive control is the fact that it prevents disclosure, but it usually does not offers any means of detecting disclosure. Source: DUPUIS, Clement, CISSP Open Study Guide on domain 5, cryptography, April 1999.
NEW QUESTION 360
Which of the following is not a critical security aspect of Operations Controls?
- A. Operators using resources.
- B. Data media used.
- C. Controls over hardware.
- D. Environmental controls.
Answer: D
Explanation:
While it is important that environmental concerns are addressed they are part of the
Physical Security Domain.
All of the other answers fall directly under Operations Security.
NEW QUESTION 361
Another model that allows two software components to communicate
with each other independent of their platforms operating systems and
languages of implementation is:
- A. Sandbox
- B. Basic Object Model (BOM)
- C. Spiral Model
- D. Common Object Model (COM)
Answer: D
Explanation:
As in the object-oriented paradigm, COM works with encapsulated
objects. Communications with a COM object are through an
interface contract between an object and its clients that defines the
functions that are available in the object and the behavior of the
object when the functions are calleD.
*Answer a sandbox, is an access
control-based protection mechanism. It is commonly applied to
restrict the access rights of mobile code that is downloaded from a
Web site as an applet. The code is set up to run in a sandbox that
blocks its access to the local workstations hard disk, thus preventing
the code from malicious activity. The sandbox is usually interpreted
by a virtual machine such as the Java Virtual MachinE.
*Answer BOM is a distracter.
* Spiral Model refers to the software development life cycle.
NEW QUESTION 362
Which of the following questions are least likely to help in assessing controls covering audit trails?
- A. Are incidents monitored and tracked until resolved?
- B. Does the audit trail provide a trace of user actions?
- C. Is access to online logs strictly controlled?
- D. Is there separation of duties between security personnel who administer the access control function and those who administer the audit trail?
Answer: A
Explanation:
Audit trails maintain a record of system activity by system or application processes and by user activity. In conjunction with appropriate tools and procedures, audit trails can provide individual accountability, a means to reconstruct events, detect intrusions, and identify problems. Audit trail controls are considered technical controls. Monitoring and tracking of incidents is more an operational control related to incident response capability.
Reference(s) used for this question: SWANSON, Marianne, NIST Special Publication 800-26, Security Self-Assessment Guide for Information Technology Systems, November 2001 (Pages A-50 to A-51).
NOTE: NIST SP 800-26 has been superceded By: FIPS 200, SP 800-53, SP 800-53A You can find the new replacement at: http://csrc.nist.gov/publications/PubsSPs.html However, if you really wish to see the old standard, it is listed as an archived document at: http://csrc.nist.gov/publications/PubsSPArch.html
NEW QUESTION 363
What mechanism automatically causes an alarm originating in a data center to be transmitted over the local municipal fire or police alarm circuits for relaying to both the local police/fire station and the appropriate headquarters?
- A. Proprietary alarm
- B. An auxiliary station alarm
- C. Central station alarm
- D. A remote station alarm
Answer: B
Explanation:
Explanation/Reference:
Explanation:
The mechanism that automatically causes an alarm originating in a data center to be transmitted over the local municipal fire or police alarm circuits for relaying to both the local police/fire station and the appropriate headquarters is known as an auxiliary station alarm.
Alarm systems may have auxiliary alarms that ring at the local fire or police stations. Most central station systems include this feature, which requires permission form the local authorities before implementation.
Incorrect Answers;
A: Central Station Systems are operated and monitored around the clock by private security firms. The central stations are signaled by detectors over leased lines. Most central station systems include auxiliary alarms that ring at the local fire or police stations. However, the name of the alarm system that rings at the local fire or police stations is 'auxiliary alarm'. Therefore, this answer is incorrect.
B: Proprietary Systems are similar to the central station systems, except that the monitoring system is owned and operated by the customer. Proprietary alarm is not name of the alarm that rings at the local fire or police stations. Therefore, this answer is incorrect.
C: A remote station alarm is not the alarm that rings at the local fire or police stations. Therefore, this answer is incorrect.
References:
Krutz, Ronald L. and Russell Dean Vines, The CISSP and CAP Prep Guide: Mastering CISSP and CAP, Wiley Publishing, Indianapolis, 2007, p. 474
NEW QUESTION 364
Drag and Drop Question
Match the level of evaluation to the correct common criteria (CC) assurance level.
Drag each level of evaluation on the left to is corresponding CC assurance level on the right
Answer:
Explanation:
NEW QUESTION 365
A company has decided that they need to begin maintaining assets deployed in the enterprise.
What approach should be followed to determine and maintain ownership information to bring the company into compliance?
- A. Asset ownership database using domain login records
- B. Asset baseline using commercial off the shelf software
- C. A script to report active user logins on assets
- D. Enterprise asset management framework
Answer: D
NEW QUESTION 366
The use of private and public encryption keys is fundamental in the implementation of which of the following?
- A. Diffie-Hellman algorithm
- B. Advanced Encryption Standard (AES)
- C. Message Digest 5 (MD5)
- D. Secure Sockets Layer (SSL)
Answer: A
Explanation:
Section: Security Architecture and Engineering
Explanation/Reference:
NEW QUESTION 367
2
The ISC Code of Ethics does not include which of the following behaviors for a CISSP:
- A. Legality
- B. Control
- C. Ethical behavior
- D. Honesty
Answer: B
Explanation:
Explanation/Reference:
Explanation:
2 2
ISC code of Ethics does not refer to control. To follow the ISC code of Ethics you should act honorably, honestly, justly, responsibly, and legally, and protect society.
Incorrect Answers:
2
A: To follow the ISC code of Ethics you should act honestly.
2
B: To follow the ISC code of Ethics you should use ethical behavior as you should act honorably, honestly, justly, responsibly, and legally, and protect society.
2
C: To follow the ISC code of Ethics you should act legally.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 1062
NEW QUESTION 368
To understand the "whys" in crime, many times it is necessary to understand MOM. Which of the following is not a component of MOM?
- A. Means
- B. Methods
- C. Motivation
- D. )Opportunities
Answer: B
Explanation:
Reference: pg 600 Shon Harris: All-in-One CISSP Certification
NEW QUESTION 369
Which choice below would NOT be a common element of a transaction
trail?
- A. Who processed the transaction
- B. At which terminal the transaction was processed
- C. The date and time of the transaction
- D. Why the transaction was processed
Answer: D
Explanation:
Why the transaction was processed is not
initially a concern of the audit log, but we will investigate it later. The other three elements are all important information that the audit log of the transaction should record.
NEW QUESTION 370
Which of the following is the biggest concern with firewall security?
- A. Buffer overflows
- B. Distributed denial of service (DDOS) attacks
- C. Complex configuration rules leading to misconfiguration
- D. Internal hackers
Answer: C
Explanation:
Firewalls tend to give a false sense of security. They can be very hard to bypass but they need to be properly configured. The complexity of configuration rules can introduce a vulnerability when the person responsible for its configuration does not fully understand all possible options and switches. Denial of service attacks mainly concerns availability.
Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-
Hill/Osborne, 2002, Chapter 3: Telecommunications and Network Security (page 412).
NEW QUESTION 371
A confidential number to verify a user's identity is called a:
- A. password
- B. PIN
- C. challenge
- D. userid
Answer: B
NEW QUESTION 372
In a Public Key Infrastructure, how are public keys published?
- A. They are sent via e-mail.
- B. They are sent by owners.
- C. They are not published.
- D. Through digital certificates.
Answer: D
Explanation:
Public keys are published through digital certificates, signed by certification authority (CA), binding the certificate to the identity of its bearer.
A bit more details:
Although "Digital Certificates" is the best (or least wrong!) in the list of answers presented, for the past decade public keys have been published (ie: made known to the World) by the means of a LDAP server or a key distribution server (ex.: http://pgp.mit.edu/). An indirect publishing method is through OCSP servers (to validate digital signatures' CRL)
Reference used for this question:
TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.
and
http://technet.microsoft.com/en-us/library/dd361898.aspx
NEW QUESTION 373
Examine the following characteristics and identify which answer best indicates the likely cause of this behavior:
-Core operating system files are hidden
-Backdoor access for attackers to return
-Permissions changing on key files
-A suspicious device driver
-Encryption applied to certain files without explanation
-
Logfiles being wiped
- A. Kernel-mode Rootkit
- B. Malware
- C. User-mode Rootkit
- D. Kernel-mode Badware
Answer: A
Explanation:
Rootkits are software that is designed to get, keep and provide access to attackers by hooking into key components of the operating system like the kernel or system drivers. Rootkits commonly try to hide their presence by affecting operating system functionality and can subvert detection software like Antivirus Scanners.
Removing a rootkit may be impossible because the software can irrevocably change components of the operating system. The OS may need to be completely reinstalled to remove the infestation.
At any rate, a computer infected with ANY malware should never be trusted again and infestation should be mitigated by a completely new install of the OS from trusted media.
The following answers are incorrect:
-User-Mode Rootkit: This isn't correct because User-mode rootkits don't include device drivers.
-Malware: This isn't a bad answer but it isn't as specific as the correct answer. Malware is a very broad term that describes any software that is written to do something nefarious.
-Kernel-mode Badware: This isn't really a computer term. But it should be.
The following reference(s) was used to create this question: 2013. Official Security+ Curriculum.
NEW QUESTION 374
......
Pass ISC CISSP Premium Files Test Engine pdf - Free Dumps Collection: https://www.actualtestsquiz.com/CISSP-test-torrent.html
New 2021 Realistic CISSP Dumps Test Engine Exam Questions in here: https://drive.google.com/open?id=1rRj8mCx43wS-Ov6u_ijAcuOoVwM8oCkQ
