CISSP PDF Dumps Real 2024 Recently Updated Questions
Released ISC CISSP Updated Questions PDF
NEW QUESTION # 256
When referring to the data structures of a packet, the term Protocol Data Unit (PDU) is used, what is the proper term to refer to a single unit of TCP data at the transport layer?
- A. TCP segment.
- B. TCP datagram.
- C. TCP frame.
- D. TCP packet.
Answer: A
Explanation:
A TCP Segment is the group of TCP data tramsmitted at the Transport Layer. TCP
is segment based network technology.
The message is sent to the transport layer, where TCP does its magic on the data. The bundle of
data is now a segment. If the message is being transmitted over TCP, it is referred to as a
"segment."
Protocol Data Unit Layers
The following answers are incorrect:
TCP datagram. Is incorrect because a TCP datagram is only a distractor, IP datagram would be
the proper terminology. TCP is segment based network technology.
TCP frame. Is incorrect because a TCP frame is only a distractor, Ethernet Frame would be the
proper terminology. TCP is segment based network technology.
TCP packet. Is incorrect because a TCP packet is only a distractor. TCP is segment based network technology.
References(s) used for this question:
Wikipedia http://en.wikipedia.org/wiki/Transport_layer Wikipedia http://en.wikipedia.org/wiki/Transmission_Control_Protocol#TCP_segment_structure
TCP/IP Illustrated, Volume 1: The Protocols, Addison-Wesley, 1994, ISBN 0-201-63346-9. http://www.infocellar.com/networks/osi-model.htm
NEW QUESTION # 257
Which of the following best corresponds to the type of memory addressing where the address location that is specified in the program instruction contains the address of the final desired location?
- A. Indirect addressing
- B. Direct addressing
- C. Program addressing
- D. Indexed addressing
Answer: A
Explanation:
An addressing mode found in many processors' instruction sets where the instruction contains the address of a memory location which contains the address of the operand (the "effective address") or specifies a register which contains the effective address. Indirect addressing is often combined with pre- or post- increment or decrement addressing, allowing the address of the operand to be increased or decreased by one (or some specified number) either before or after using it.
NEW QUESTION # 258
An organization is found lacking the ability to properly establish performance indicators for its Web hosting solution during an audit. What would be the MOST probable cause?
- A. Inadequate cost modeling
- B. Improper deployment of the Service-Oriented Architecture (SOA)
- C. Insufficient Service Level Agreement (SLA)
- D. Absence of a Business Intelligence (BI) solution
Answer: C
Explanation:
Section: Security Operations
NEW QUESTION # 259
Which of the following statements pertaining to quantitative risk analysis is false?
- A. It requires little experience to apply
- B. Portion of it can be automated
- C. It requires a high volume of information
- D. It involves complex calculations
Answer: A
Explanation:
Assigning the values for the inputs to a purely quantitative risk assessment requires both a lot of time and significant experience on the part of the assessors. The most experienced employees or representatives from each of the departments would be involved in the process. It is NOT an easy task if you wish to come up with accurate values.
"It can be automated" is incorrect. There are a number of tools on the market that automate the process of conducting a quantitative risk assessment.
"It involves complex calculations" is incorrect. The calculations are simple for basic scenarios but could become fairly complex for large cases. The formulas have to be applied correctly.
"It requires a high volume of information" is incorrect. Large amounts of information are required in order to develop reasonable and defensible values for the inputs to the quantitative risk assessment.
References:
CBK, pp. 60-61
AIO3, p. 73, 78
The Cissp Prep Guide - Mastering The Ten Domains Of Computer Security - 2001, page
24
NEW QUESTION # 260
Data which is properly secured and can be described with terms like genuine or not corrupted from the original refers to data that has a high level of what?
- A. Non-Repudiation
- B. Authorization
- C. Availability
- D. Authenticity
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Authenticity is a close relative of authentication. Authenticity is the process of ensuring that a message received is the same message that was sent and has not been tampered with or altered. Lawyers, as a real-world case in point, are fanatical about ensuring that evidence is authentic and has not been tampered with or altered in any way to ensure a fair hearing for the accused.
Incorrect Answers:
B: Authorization is the rights and permissions granted to an individual (or process), which enable access to a computer resource. Once a user's identity and authentication are established, authorization levels determine the extent of system rights that an operator can hold. This is not what is described in the question.
C: Availability ensures the reliable and timely access to data or computing resources by the appropriate personnel. In other words, availability guarantees that the systems are up and running when they are needed. In addition, this concept guarantees that the security services needed by the security practitioner are in working order. This is not what is described in the question.
D: Nonrepudiation is the assurance that someone cannot deny something. Typically, nonrepudiation refers to the ability to ensure that a party to a contract or a communication cannot deny the authenticity of their signature on a document or the sending of a message that they originated. This is not what is described in the question.
References:
http://www.yourdictionary.com/authenticity
NEW QUESTION # 261
Behavioral-based systems are also known as?
- A. Pattern matching systems
- B. Profile-based systems
- C. Misuse detective systems
- D. Rule-based IDS
Answer: B
Explanation:
There are two complementary approaches to detecting intrusions, knowledge-based approaches and behavior-based approaches. This entry describes the second approach. It must be noted that very few tools today implement such an approach, even if the founding Denning paper {D. Denning, An Intrusion Detection Model, IEEE transactions on software engineering} recognizes this as a requirement for IDS systems.
Behavior-based intrusion detection techniques assume that an intrusion can be detected by observing a deviation from normal or expected behavior of the system or the users. The model of normal or valid behavior is extracted from reference information collected by various means. The intrusion detection system later compares this model with the current activity. When a deviation is observed, an alarm is generated. In other words, anything that does not correspond to a previously learned behavior is considered intrusive. Therefore, the intrusion detection system might be complete (i.e. all attacks should be caught), but its accuracy is a difficult issue (i.e. you get a lot of false alarms).
Advantages of behavior-based approaches are that they can detect attempts to exploit new and unforeseen vulnerabilities. They can even contribute to the (partially) automatic discovery of these new attacks. They are less dependent on operating system-specific mechanisms. They also help detect 'abuse of privileges' types of attacks that do not actually involve exploiting any security vulnerability. In short, this is the paranoid approach:
Everything which has not been seen previously is dangerous.
The high false alarm rate is generally cited as the main drawback of behavior-based techniques because the entire scope of the behavior of an information system may not be covered during the learning phase. Also, behavior can change over time, introducing the need for periodic online retraining of the behavior profile, resulting either in unavailability of the intrusion detection system or in additional false alarms. The information system can undergo attacks at the same time the intrusion detection system is learning the behavior.
As a result, the behavior profile contains intrusive behavior, which is not detected as anomalous.
Herve Debar
IBM Zurich Research Laboratory
The following answers are incorrect:
Pattern matching systems are signature-based (e.g. Anti-virus).
Misuse detection systems is another name for signature-based IDSs.
Rule-based IDS is a distractor.
The following reference(s) were/was used to create this question:
Shon Harris AIO - 4th edition, Page 254
and
http://www.sans.org/security-resources/idfaq/behavior_based.php
NEW QUESTION # 262
Which statement accurately describes the difference between 802.11b
WLAN ad hoc and infrastructure modes?
- A. Wireless nodes can communicate peer-to-peer in the infrastructure mode.
- B. The ad hoc mode requires an Access Point to communicate to the wired network.
- C. Access points are rarely used in 802.11b WLANs.
- D. Wireless nodes can communicate peer-to-peer in the ad hoc mode.
Answer: D
Explanation:
Nodes on an IEEE 802.11b wireless LANs can communicate in one of two modes: ad hoc or infrastructure. In ad hoc mode, the wireless nodes communicate directly with each other, without establishing a connection to an access point on a wired LAN. In infrastructure mode, the wireless nodes communicate to an access point, which operates similarly to a bridge or router and manages traffic between the wireless network and the wired network. Source: Wireless Security Essentials by Russell Dean Vines (Wiley, 2002). Figure A.3 shows access points attached to a wired LAN to create an Infrastructure Mode 802.11b WLAN.
NEW QUESTION # 263
What is called the act of a user professing an identity to a system, usually in the form of a log-on ID?
- A. Authorization
- B. Identification
- C. Authentication
- D. Confidentiality
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Identification involves a user supplying identification information using a username, user ID, or account number.
Incorrect Answers:
A: Authentication involves verifying a user's identification information using a passphrase, PIN value, biometric, one-time password, or password.
C: Authorization is when a system establishes whether the user is authorized to access the particular resource and what actions he is permitted to perform on that resource.
D: Confidentiality is used to make sure that the required level of secrecy is imposed at every junction of data processing and prevents unauthorized disclosure.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 24, 166, 203
NEW QUESTION # 264
Access control allows you to exercise directing influence over which of the following aspects of a system?
- A. User logs and content.
- B. Behavior, use, and content.
- C. Behavior, user, and content provider.
- D. None of the choices.
Answer: B
Explanation:
Access control is the collection of mechanisms that permits managers of a system to exercise a directing or restraining influence over the behavior, use, and content of a system. It permits management to specify what users can do, which resources they can access, and what operations they can perform on a system.
NEW QUESTION # 265
The Wired Equivalency Privacy algorithm (WEP) of the 802.11 Wireless
LAN Standard uses which of the following to protect the confidentiality of information being transmitted on the LAN?
- A. A public/private key pair that is shared between a mobile station
(e.g., a laptop with a wireless Ethernet card) and a base station
access point - B. A secret key that is shared between a mobile station (e.g., a laptop with a wireless Ethernet card) and a base station access point
- C. Frequency shift keying (FSK) of the message that is sent between a
mobile station (e.g., a laptop with a wireless Ethernet card) and a
base station access point - D. A digital signature that is sent between a mobile station (e.g., a
laptop with a wireless Ethernet card) and a base station access point
Answer: B
Explanation:
The transmitted packets are encrypted with a secret key and an
Integrity Check (IC) field comprised of a CRC-32 check sum that is
attached to the message. WEP uses the RC4 variable key-size
stream cipher encryption algorithm. RC4 was developed in 1987 by
Ron Rivest and operates in output feedback mode. Researchers at
the University of California at Berkely ([email protected])
have found that the security of the WEP algorithm can be
compromised, particularly with the following attacks:
Passive attacks to decrypt traffic based on statistical analysis
Active attack to inject new traffic from unauthorized mobile
stations, based on known plaintext
Active attacks to decrypt traffic, based on tricking the access
point
Dictionary-building attack that, after analysis of about a day's
worth of traffic, allows real-time automated decryption of all
traffic
The Berkeley researchers have found that these attacks are
effective against both the 40-bit and the so-called 128-bit versions of
WEP using inexpensive off-the-shelf equipment. These attacks can
also be used against networks that use the 802.11b Standard, which
is the extension to 802.11 to support higher data rates, but does not
change the WEP algorithm.
The weaknesses in WEP and 802.11 are being addressed by the
IEEE 802.11i Working Group. WEP will be upgraded to WEP2 with
the following proposed changes:
Modifying the method of creating the initialization vector (IV)
Modifying the method of creating the encryption key
Protection against replays
Protection against IV collision attacks
Protection against forged packets
In the longer term, it is expected that the Advanced Encryption
Standard (AES) will replace the RC4 encryption algorithm currently
used in WEP.
NEW QUESTION # 266
Which backup method is additive because the time and tape space required for each night's backup grows during the week as it copies the day's changed files and the previous days' changed files up to the last full backup?
- A. full backup method.
- B. incremental backup method.
- C. differential backup method.
- D. tape backup method.
Answer: C
Explanation:
The Differential Backup Method is additive because the time and tape space required for each night's backup grows during the week as it copies the day's changed files and the previous days' changed files up to the last full backup. Archive Bits
Unless you've done a lot of backups in your time you've probably never heard of an Archive Bit. An archive bit is, essentially, a tag that is attached to every file. In actuality, it is a binary digit that is set on or off in the file, but that's crummy technical jargon that doesn't really tell us anything. For the sake of our discussion, just think of it as the flag on a mail box. If the flag is up, it means the file has been changed. If it's down, then the file is unchanged.
Archive bits let the backup software know what needs to be backed up. The differential and incremental backup types rely on the archive bit to direct them. Backup Types Full or Normal The "Full" or "normal" backup type is the most standard. This is the backup type that you would use if you wanted to backup every file in a given folder or drive. It backs up everything you direct it to regardless of what the archive bit says. It also resets all archive bits (puts the flags down). Most backup software, including the built-in Windows backup software, lets you select down to the individual file that you want backed up. You can also choose to backup things like the "system state".
Incremental When you schedule an incremental backup, you are in essence instructing the software to only backup files that have been changed, or files that have their flag up. After the incremental backup of that file has occured, that flag will go back down. If you perform a normal backup on Monday, then an incremental backup on Wednesday, the only files that will be backed up are those that have changed since Monday. If on Thursday someone deletes a file by accident, in order to get it back you will have to restore the full backup from Monday, followed by the Incremental backup from Wednesday.
Differential Differential backups are similar to incremental backups in that they only backup files with their archive bit, or flag, up. However, when a differential backup occurs it does not reset those archive bits which means, if the following day, another differential backup occurs, it will back up that file again regardless of whether that file has been changed or not. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 69.
And: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter 9: Disaster Recovery and Business continuity (pages 617-619). And: http://www.brighthub.com/computing/windows-platform/articles/24531.aspx
NEW QUESTION # 267
Which of the following is an advantage of using a high-level programming language?
- A. It decreases the total amount of code writers
- B. It requires programmer-controlled storage management
- C. It allows programmers to define syntax
- D. It enforces coding standards
Answer: A
NEW QUESTION # 268
Covert Channel Analysis is FIRST introduced at what level of the TCSEC rating?
- A. C2 and above.
- B. B2 and above.
- C. B1 and above.
- D. B3 and above.
Answer: B
Explanation:
Explanation/Reference:
Explanation:
In the Orange Book, covert channels in operating systems are not addressed until security level B2 and above because these are the systems that would be holding data sensitive enough for others to go through all the necessary trouble to access data in this fashion.
B2: Structured Protection: The security policy is clearly defined and documented, and the system design and implementation are subjected to more thorough review and testing procedures. This class requires more stringent authentication mechanisms and well-defined interfaces among layers. Subjects and devices require labels, and the system must not allow covert channels. A trusted path for logon and authentication processes must be in place, which means the subject communicates directly with the application or operating system, and no trapdoors exist. There is no way to circumvent or compromise this communication channel. Operator and administration functions are separated within the system to provide more trusted and protected operational functionality. Distinct address spaces must be provided to isolate processes, and a covert channel analysis is conducted. This class adds assurance by adding requirements to the design of the system.
The type of environment that would require B2 systems is one that processes sensitive data that require a higher degree of security. This type of environment would require systems that are relatively resistant to penetration and compromise.
Incorrect Answers:
A: Covert Channel Analysis is not used at layer C2.
B: Covert Channel Analysis is not used at layer B1.
D: B3 is not the lowest level that uses Covert Channel Analysis. Level B2 uses Covert Channel Analysis.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 380, 396
NEW QUESTION # 269
Which protocol is used to resolve a known IP address to an unknown
MAC address?
- A. TFTP
- B. ICMP
- C. ARP
- D. RARP
Answer: C
Explanation:
The Address Resolution Protocol (ARP) sends a broadcast asking for the host with a specified IP address to reply with its MAC, or hardware address. This information is kept in the ARP Cache.
*the Reverse Address Resolution Protocol (RARP) is commonly used on diskless machines, when the MAC is known, but not the IP address. It asks a RARP server to provide a valid IP address, which is somewhat the reverse of ARP.
*the Internet Control Message Protocol (ICMP) is a management protocol for IP.
*the Trivial File Transfer Protocol (TFTP), is a stripped-down version of the File Transfer Protocol (FTP).
Source:
CCNA Study Guide by Todd Lammle, Donald Porter, and James
Chellis (Sybex, 1999).
NEW QUESTION # 270
What is the MAIN purpose of conducting a business impact analysis (BIA)?
- A. To determine the controls required to return to business critical operations
- B. To determine the effect of mission-critical information system failures on core business processes
- C. To determine the critical resources required to recover from an incident within a specified time period
- D. To determine the cost for restoration of damaged information system
Answer: B
NEW QUESTION # 271
Which of the following identifies the encryption algorithm selected by NIST for the new
Advanced Encryption Standard?
- A. Rijndael
- B. Twofish
- C. Serpent
- D. RC6
Answer: A
Explanation:
The_answer: Rijndael. Rijndael is the new approved method of encrypting sensitive but unclassified information for the U.S. government. It has been accepted by and is also widely used in the public arena as well. It has low memory requirements and has been constructed to easily defend against timing attacks.
The following answers are incorrect: Twofish. Twofish was among the final candidates chosen for AES, but was not selected.
Serpent. Serpent was among the final candidates chosen for AES, but was not selected.
RC6. RC6 was among the final candidates chosen for AES, but was not selected.
The following reference(s) were/was used to create this question:
ISC2 OIG, 2007 p. 622, 629-630
Shon Harris AIO, v.3 p 247-250
NEW QUESTION # 272
ICMP and IGMP belong to which layer of the OSI model?
- A. Transport
- B. Network
- C. Link
- D. Datagram
Answer: B
Explanation:
The Network layer (layer 3) is responsible for adding routing information to the data.
The Network layer accepts the segment from the Transport layer and adds information to it to
create a packet. The packet includes the source and destination IP addresses. T
The routing protocols are located at this layer and include the following:
Internet Control Message Protocol (ICMP)
Routing Information Protocol (RIP)
Open Shortest Path First (OSPF)
Border Gateway Protocol (BGP)
Internet Group Management Protocol (IGMP)
Internet Protocol (IP)
Internet Packet Exchange (IPX)
Pg. 78 Tittel: CISSP Study Guide
NEW QUESTION # 273
A business continuity plan should list and prioritize the services that need to be brought back after a disaster strikes. Which of the following services is more likely to be of primary concern?
- A. Marketing/Public Relations
- B. Facilities security
- C. Data/Telecomm/IS facilities
- D. IS Operations
Answer: C
NEW QUESTION # 274
A financial services organization has employed a security consultant to review processes used by employees across various teams. The consultant interviewed a member of the application development practice and found gaps in their threat model. Which of the following correctly represents a trigger for when a threat model should be revised?
- A. After a modification to the firewall rule policy
- B. A new data repository is added.
- C. is After operating system (OS) patches are applied
- D. A new developer is hired into the team.
Answer: D
NEW QUESTION # 275
Which of the following is an IP address that is private (i.e. reserved for internal networks, and not a valid address to use on the Internet)?
- A. 11.0.42.5
- B. 10.0.42.5
- C. 13.0.42.5
- D. 12.0.42.5
Answer: B
Explanation:
This is a valid Class A reserved address. For Class A, the reserved addresses are
10.0.0.0
- 10.255.255.255.
The following answers are incorrect:
11.0.42.5
Is incorrect because it is not a Class A reserved address.
12.0.42.5
Is incorrect because it is not a Class A reserved address.
13.0.42.5
Is incorrect because it is not a Class A reserved address.
The private IP address ranges are defined within RFC 1918: RFC 1918 private ip address range
References:
3Com http://www.3com.com/other/pdfs/infra/corpinfo/en_US/501302.pdf AIOv3 Telecommunications and Networking Security (page 438)
NEW QUESTION # 276
Which of the following layers supervises the control rate of packet transfers in an Open Systems Interconnections (OSI) implementation?
- A. Transport
- B. Session
- C. Physical
- D. Network
Answer: A
Explanation:
The transport layer defines how to address the physical locations and /or devices on the network, how to make connections between nodes, and how to handle the networking of messages. It is responsible for maintaining the end-to-end integrity and control of the session. Services located in the transport layer both segment and reassemble the data from upper-layer applications and unite it onto the same data stream, which provides end-to-end data transport services and establishes a logical connection between the sending host and destination host on a network. The transport layer is also responsible for providing mechanisms for multiplexing upper-layer applications, session establishment, and the teardown of virtual circuits. -Ronald Krutz The CISSP PREP Guide (gold edition) pg 275-276
"Transport Layer The agreement on these issues before transferring data helps provide more reliable data transfer, error detection and correction, and flow control and it optimizes network services needed to perform these tasks." Pg. 318 - 319 Shon Harris: All-In-One CISSP Certification Guide.
NEW QUESTION # 277
......
CISSP Dumps and Practice Test (1481 Exam Questions): https://www.easy4engine.com/CISSP-test-engine.html
Guide (New 2024) Actual ISC CISSP Exam Questions: https://drive.google.com/open?id=1VTVcS9bhRxLIbr6AQzv8UVHY60zDhb7b
