Pass ISC CISSP exam questions - convert Test Engine to PDF
Pass Your CISSP Exam Easily - Real CISSP Practice Dump Updated Dec 06, 2021
Study Tips
Below are some helpful study tips you can refer to while preparing for the CISSP test:
- Attend online programs focused on the CISSP and best practices in security to increase your confidence in facing the real exam.
- Take advantage of the most up-to-date security materials and online webinars focused on security operations and software development security.
- Get an in-depth & real-life experience that your job and your certification can apply to.
- Seek guidance from security practitioners who have already earned certification for their CISSP skills.
- Look at the security management prep exam questions to see what valuable knowledge you can collect.
Exam Prerequisites
To be CISSP certified, you must have at least five years of industrial experience in IT and security in a combination with two or more of the eight domains of the CISSP objectives. One year of required experience can be fulfilled by receiving a four-year university degree or an additional certification from the approved (ISC)2 list.
NEW QUESTION 384
Refer to the information below to answer the question.
A large organization uses unique identifiers and requires them at the start of every system session. Application access is based on job classification. The organization is subject to periodic independent reviews of access controls and violations. The organization uses wired and wireless networks and remote access. The organization also uses secure connections to branch offices and secure backup and recovery strategies for selected information and processes.
What MUST the access control logs contain in addition to the identifier?
- A. Associated clearance
- B. Security classification
- C. Denied access attempts
- D. Time of the access
Answer: D
NEW QUESTION 385
Which of the following best defines social engineering?
- A. Illegal copying of software
- B. Using people skills to obtain proprietary information
- C. Gathering information from discarded manuals and printouts
- D. Destruction or alteration of data
Answer: B
Explanation:
Using people skills to obtain proprietary information.
*Answer "Illegal copying of software" is software piracy
* answer "Gathering information from discarded manuals and printouts" is dumpster diving;
*answer "Destruction or alteration of data" is a violation of integrity.
NEW QUESTION 386
In Mandatory Access Control, sensitivity labels attached to object contain what information?
- A. The items's need to know
- B. The item's classification and category set
- C. The item's category
- D. The item's classification
Answer: B
Explanation:
A Sensitivity label must contain at least one classification and one category set.
Category set and Compartment set are synonyms, they mean the same thing. The sensitivity label must contain at least one Classification and at least one Category. It is common in some environments for a single item to belong to multiple categories. The list of all the categories to which an item belongs is called a compartment set or category set.
The following answers are incorrect:
the item's classification. Is incorrect because you need a category set as well.
the item's category. Is incorrect because category set and classification would be both be required.
The item's need to know. Is incorrect because there is no such thing. The need to know is indicated by the catergories the object belongs to. This is NOT the best answer.
Reference(s) used for this question:
OIG CBK, Access Control (pages 186 - 188)
AIO, 3rd Edition, Access Control (pages 162 - 163)
AIO, 4th Edittion, Access Control, pp 212-214.
Wikipedia - http://en.wikipedia.org/wiki/Mandatory_Access_Control
NEW QUESTION 387
The adoption of an enterprise-wide Business Continuity (BC) program requires which of the following?
- A. A completed Business Impact Analysis (BIA)
- B. Good communication throughout the organization
- C. Formation of Disaster Recovery (DR) project team
- D. Well-documented information asset classification
Answer: D
NEW QUESTION 388
Which of the following is often implemented by a one-for-one disk to disk ratio?
- A. RAID Level 5
- B. RAID Level 0
- C. RAID Level 2
- D. RAID Level 1
Answer: D
Explanation:
This is often implemented by a one-for-one disk-to-disk ratio.
RAID Level 2 provides redundancy by writing all data to two or more drives set. The performance of a level 1 array tends to be faster on reads and slower on writes compared to a single drive, but if either of the drive sets fails, no data is lost. This is a good entry-level redundant system, since only two drives are required as a minimum; however, since one drive is used to store a duplicate of the data, the cost per megabyte is high. This level is commonly referred to as mirroring.
Please visit http://www.sohoconsult.ch/raid/raid1.html for a nice overview of RAID Levels.
For the purpose of the exam you must be familiar with RAID 0 to 5, 10, and 50.
References:
http://www.sohoconsult.ch/raid/raid1.html
and
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, 2001, John Wiley & Sons, Page 65.
NEW QUESTION 389
Which of the following types of business continuity tests includes assessment of resilience to internal and external risks without endangering live operations?
- A. Simulation
- B. Walkthrough
- C. Parallel
- D. White box
Answer: C
Explanation:
Section: Security Operations
NEW QUESTION 390
What is the 802.11 standard related to?
- A. Wireless network communications
- B. Public Key Infrastructure (PKI)
- C. The OSI/ISO model
- D. Packet-switching technology
Answer: A
Explanation:
Explanation/Reference:
Explanation:
802.11 is a set specifications for implementing wireless local area network (WLAN) computer communication.
Incorrect Answers:
A: The 802.11 standard is not for PKI. It is a specification for wireless communication on a LAN.
C: The 802.11 standard does not concern packet-switching. It is a specification for wireless communication on a LAN.
D: The 802.11 standard is not related to the OSI model or the ISO model. The 802.11 standard relates to wireless communication on a LAN.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 715
NEW QUESTION 391
In order for application developers to detect potential vulnerabilities earlier during the Software Development Life Cycle (SDLC), which of the following safeguards should be implemented FIRST as part of a comprehensive testing framework?
- A. Threat modeling
- B. Automated testing
- C. Source code review
- D. Acceptance testing
Answer: C
NEW QUESTION 392
Which of the following combinations would MOST negatively affect availability?
- A. Denial of Service (DoS) attacks and outdated hardware
- B. Unauthorized transactions and outdated hardware
- C. Unauthorized transactions and denial of service attacks
- D. Fire and accidental changes to data
Answer: A
NEW QUESTION 393
What is the main concern with single sign-on?
- A. The users' password would be to hard to remember
- B. The security administrator's workload would increase
- C. User access rights would be increased
- D. Maximum unauthorized access would be possible if a password is disclosed
Answer: D
NEW QUESTION 394
What is the best description for CHAP Challenge Handshake Authentication Protocol?
- A. Passwords are sent in clear text
- B. It is substandard to PAP
- C. Passwords are not used, a digital signature is sent
- D. Passwords are not sent in clear text
- E. It was used with PS2's and has been discontinued
Answer: D
Explanation:
Passwords are not sent in clear text. The server performing the authentication sends a challenge value and the user types in the password. The password is used to encrypt the challenge value then is sent back to the authentication server.
NEW QUESTION 395
If any server in the cluster crashes, processing continues transparently, however, the cluster suffers some performance degradation. This implementation is sometimes called a:
- A. cluster farm
- B. host farm
- C. client farm
- D. server farm
Answer: D
Explanation:
If any server in the cluster crashes, processing continues transparently, however,
the cluster suffers some performance degradation. This implementation is sometimes called a
"server farm."
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, 2001, John Wiley & Sons, Page 67.
NEW QUESTION 396
Which of the following is most relevant to determining the maximum effective cost of access control?
- A. the cost to replace lost data.
- B. budget planning related to base versus incremental spending.
- C. management's perceptions regarding data importance.
- D. the value of information that is protected.
Answer: D
Explanation:
The cost of access control must be commensurate with the value of the information that is being protected. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 49
NEW QUESTION 397
Which of the following is the BEST way to protect against Structured Query language (SQL) injection?
- A. Ratfrict um of SELECT command.
- B. Restrict HyperText Markup Language (HTML) source code
- C. Enforce boundary checking.
- D. Use stored procedures.
Answer: D
NEW QUESTION 398
Refer to the information below to answer the question.
In a Multilevel Security (MLS) system, the following sensitivity labels are used in increasing levels of sensitivity: restricted, confidential, secret, top secret. Table A lists the clearance levels for four users, while Table B lists the security classes of four different files.
In a Bell-LaPadula system, which user has the MOST restrictions when writing data to any of the four files?
- A. User C
- B. User D
- C. User B
- D. User A
Answer: B
NEW QUESTION 399
Which of the following risk handling technique involves the practice of passing on the risk to another entity, such as an insurance company?
- A. Risk Mitigation
- B. Risk Acceptance
- C. Risk Avoidance
- D. Risk transfer
Answer: D
Explanation:
Risk transfer is the practice of passing on the risk in question to another entity, such as an insurance company. Let us look at one of the examples that were presented above in a different way.
For your exam you should know below information about risk assessment and treatment: A risk assessment, which is a tool for risk management, is a method of identifying vulnerabilities and threats and assessing the possible impacts to determine where to implement security controls. A risk assessment is carried out, and the results are analyzed. Risk analysis is used to ensure that security is cost-effective, relevant, timely, and responsive to threats. Security can be quite complex, even for well-versed security professionals, and it is easy to apply too much security, not enough security, or the wrong security controls, and to spend too much money in the process without attaining the necessary objectives. Risk analysis helps companies prioritize their risks and shows management the amount of resources that should be applied to protecting against those risks in a sensible manner.
A risk analysis has four main goals:
Identify assets and their value to the organization.
Identify vulnerabilities and threats.
Quantify the probability and business impact of these potential threats.
Provide an economic balance between the impact of the threat and the cost of the countermeasure.
Treating Risk
Risk Mitigation Risk mitigation is the practice of the elimination of, or the significant decrease in the level of risk presented. Examples of risk mitigation can be seen in everyday life and are readily apparent in the information technology world. Risk Mitigation involves applying appropriate control to reduce risk. For example, to lessen the risk of exposing personal and financial information that is highly sensitive and confidential organizations put countermeasures in place, such as firewalls, intrusion detection/prevention systems, and other mechanisms, to deter malicious outsiders from accessing this highly sensitive information. In the underage driver example, risk mitigation could take the form of driver education for the youth or establishing a policy not allowing the young driver to use a cell phone while driving, or not letting youth of a certain age have more than one friend in the car as a passenger at any given time.
Risk Transfer Risk transfer is the practice of passing on the risk in question to another entity, such as an insurance company. Let us look at one of the examples that were presented above in a different way. The family is evaluating whether to permit an underage driver to use the family car. The family decides that it is important for the youth to be mobile, so it transfers the financial risk of a youth being in an accident to the insurance company, which provides the family with auto insurance. It is important to note that the transfer of risk may be accompanied by a cost. This is certainly true for the insurance example presented earlier, and can be seen in other insurance instances, such as liability insurance for a vendor or the insurance taken out by companies to protect against hardware and software theft or destruction. This may also be true if an organization must purchase and implement security controls in order to make their organization less desirable to attack. It is important to remember that not all risk can be transferred. While financial risk is simple to transfer through insurance, reputational risk may almost never be fully transferred.
Risk Avoidance Risk avoidance is the practice of coming up with alternatives so that the risk in question is not realized. For example, have you ever heard a friend, or parents of a friend, complain about the costs of insuring an underage driver? How about the risks that many of these children face as they become mobile? Some of these families will decide that the child in question will not be allowed to drive the family car, but will rather wait until he or she is of legal age (i.e., 18 years of age) before committing to owning, insuring, and driving a motor vehicle.
In this case, the family has chosen to avoid the risks (and any associated benefits) associated with an underage driver, such as poor driving performance or the cost of insurance for the child. Although this choice may be available for some situations, it is not available for all. Imagine a global retailer who, knowing the risks associated with doing business on the Internet, decides to avoid the practice. This decision will likely cost the company a significant amount of its revenue (if, indeed, the company has products or services that consumers wish to purchase). In addition, the decision may require the company to build or lease a site in each of the locations, globally, for
which it wishes to continue business. This could have a catastrophic effect on the company's
ability to continue business operations
Risk Acceptance
In some cases, it may be prudent for an organization to simply accept the risk that is presented in
certain scenarios. Risk acceptance is the practice of accepting certain risk(s), typically based on a
business decision that may also weigh the cost versus the benefit of dealing with the risk in
another way.
For example, an executive may be confronted with risks identified during the course of a risk
assessment for their organization. These risks have been prioritized by high, medium, and low
impact to the organization. The executive notes that in order to mitigate or transfer the low-level
risks, significant costs could be involved. Mitigation might involve the hiring of additional highly
skilled personnel and the purchase of new hardware, software, and office equipment, while
transference of the risk to an insurance company would require premium payments.
The executive then further notes that minimal impact to the organization would occur if any of the
reported low-level threats were realized. Therefore, he or she (rightly) concludes that it is wiser for
the organization to forgo the costs and accept the risk. In the young driver example, risk
acceptance could be based on the observation that the youngster has demonstrated the
responsibility and maturity to warrant the parent's trust in his or her judgment.
The following answers are incorrect:
Risk Transfer - Risk transfer is the practice of passing on the risk in question to another entity,
such as an insurance company. Let us look at one of the examples that were presented above in a
different way.
Risk avoidance - Risk avoidance is the practice of coming up with alternatives so that the risk in
question is not realized.
Risk Mitigation - Risk mitigation is the practice of the elimination of, or the significant decrease in
the level of risk presented.
The following reference(s) were/was used to create this question:
CISA Review Manual 2014 Page number 51
and
Official ISC2 guide to CISSP CBK 3rd edition page number 534-536
NEW QUESTION 400
Which term BEST describes a practice used to detect fraud for users or a user by forcing them to be away from the workplace for a while?
- A. Job Rotation
- B. Mandatory Vacations
- C. Least Privilege Principle
- D. Obligatory Separation
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Employees in sensitive areas should be forced to take their vacations, which is known as a mandatory vacation. While they are on vacation, other individuals fill their positions and thus can usually detect any fraudulent errors or activities. Two of the many ways to detect fraud or inappropriate activities would be the discovery of activity on someone's user account while they're supposed to be away on vacation, or if a specific problem stopped while someone was away and not active on the network. These anomalies are worthy of investigation. Employees who carry out fraudulent activities commonly do not take vacations because they do not want anyone to figure out what they are doing behind the scenes. This is why they must be forced to be away from the organization for a period of time, usually two weeks.
Incorrect Answers:
B: Least privilege means an individual should have just enough permissions and rights to fulfill his role in the company and no more. This is not what is described in the question.
C: Obligatory Separation is not a term for the process used to detect fraud for users or a user by forcing them to be away from the workplace for a while.
D: Job rotation in the workplace is a system where employees work at several jobs in a business, performing each job for a relatively short period of time. This could be used to detect fraud for users or a user by forcing them to be away from the workplace for a while. However, this question is asking for the BEST answer and Mandatory Vacations are for this specific purpose.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 127, 1235-
1236
NEW QUESTION 401
When should security isolation of the incident scene start?
- A. As soon as the disaster plan is implemented
- B. After all personnel have been evacuated
- C. When hazardous materials have been discovered at the site
- D. Immediately after the emergency is discovered
Answer: D
Explanation:
Isolation of the incident scene should begin as soon as the emergency has been discovered. Authorized personnel should attempt to secure the scene and control access; however, no one should be placed in physical danger to perform these functions. Its important for life safety that access be controlled immediately at the scene, and only by trained personnel directly involved in the disaster response. Additional injury or exposure to recovery personnel after the initial incident must be tightly controlled. Source: Emergency Management Guide for Business and Industry, Federal Emergency Management Agency, August, 1998.
NEW QUESTION 402
Which of the following security control is intended to avoid an incident from occurring?
- A. Deterrent
- B. Recovery
- C. Corrective
- D. Preventive
Answer: D
Explanation:
Preventive controls are intended to avoid an incident from occurring For your exam you should know below information about different security controls
Deterrent Controls Deterrent Controls are intended to discourage a potential attacker. Access controls act as a deterrent to threats and attacks by the simple fact that the existence of the control is enough to keep some potential attackers from attempting to circumvent the control. This is often because the effort required to circumvent the control is far greater than the potential reward if the attacker is successful, or, conversely, the negative implications of a failed attack (or getting caught) outweigh the benefits of success. For example, by forcing the identification and authentication of a user, service, or application, and all that it implies, the potential for incidents associated with the system is significantly reduced because an attacker will fear association with the incident. If there are no controls for a given access path, the number of incidents and the potential impact become infinite. Controls inherently reduce exposure to risk by applying oversight for a process. This oversight acts as a deterrent, curbing an attacker's appetite in the face of probable repercussions. The best example of a deterrent control is demonstrated by employees and their propensity to intentionally perform unauthorized functions, leading to unwanted events. When users begin to understand that by authenticating into a system to perform a function, their activities are logged and monitored, and it reduces the likelihood they will attempt such an action. Many threats are based on the anonymity of the threat agent, and any potential for identification and association with their actions is avoided at all costs. It is this fundamental reason why access controls are the key target of circumvention by attackers. Deterrents also take the form of potential punishment if users do something unauthorized. For example, if the organization policy specifies that an employee installing an unauthorized wireless access point will be fired, that will determine most employees from installing wireless access points.
Preventative Controls Preventive controls are intended to avoid an incident from occurring. Preventative access controls keep a user from performing some activity or function. Preventative controls differ from deterrent controls in that the control is not optional and cannot (easily) be bypassed. Deterrent controls work on the theory that it is easier to obey the control rather than to risk the consequences of bypassing the control. In other words, the power for action resides with the user (or the attacker). Preventative controls place the power of action with the system, obeying the control is not optional. The only way to bypass the control is to find a flaw in the control's implementation.
Compensating Controls Compensating controls are introduced when the existing capabilities of a system do not support the requirement of a policy. Compensating controls can be technical, procedural, or managerial. Although an existing system may not support the required controls, there may exist other technology or processes that can supplement the existing environment, closing the gap in controls, meeting policy requirements, and reducing overall risk. For example, the access control policy may state that the authentication process must be encrypted when performed over the Internet. Adjusting an application to natively support encryption for authentication purposes may be too costly. Secure Socket Layer (SSL), an encryption protocol, can be employed and layered on top of the authentication process to support the policy statement. Other examples include a separation of duties environment, which offers the capability to isolate certain tasks to compensate for technical limitations in the system and ensure the security of transactions. In addition, management processes, such as authorization, supervision, and administration, can be used to compensate for gaps in the access control environment.
Detective Controls Detective controls warn when something has happened, and are the earliest point in the post-incident timeline. Access controls are a deterrent to threats and can be aggressively utilized to prevent harmful incidents through the application of least privilege. However, the detective nature of access controls can provide significant visibility into the access environment and help organizations manage their access strategy and related security risk. As mentioned previously, strongly managed access privileges provided to an authenticated user offer the ability to reduce the risk exposure of the enterprise's assets by limiting the capabilities that authenticated user has. However, there are few options to control what a user can perform once privileges are provided. For example, if a user is provided write access to a file and that file is damaged, altered, or otherwise negatively impacted (either deliberately or unintentionally), the use of applied access controls will offer visibility into the transaction. The control environment can be established to log activity regarding the identification, authentication, authorization, and use of privileges on a system. This can be used to detect the occurrence of errors, the attempts to perform an unauthorized action, or to validate when provided credentials were exercised. The logging system as a detective device provides evidence of actions (both successful and unsuccessful) and tasks that were executed by authorized users.
Corrective Controls When a security incident occurs, elements within the security infrastructure may require corrective actions. Corrective controls are actions that seek to alter the security posture of an environment to correct any deficiencies and return the environment to a secure state. A security incident signals the failure of one or more directive, deterrent, preventative, or compensating controls. The detective controls may have triggered an alarm or notification, but now the corrective controls must work to stop the incident in its tracks. Corrective controls can take many forms, all depending on the particular situation at hand or the particular security failure that needs to be dealt with.
Recovery Controls Any changes to the access control environment, whether in the face of a security incident or to offer temporary compensating controls, need to be accurately reinstated and returned to normal operations. There are several situations that may affect access controls, their applicability, status, or management. Events can include system outages, attacks, project changes, technical demands, administrative gaps, and full-blown disaster situations. For example, if an application is not correctly installed or deployed, it may adversely affect controls placed on system files or even have default administrative accounts unknowingly implemented upon install. Additionally, an employee may be transferred, quit, or be on temporary leave that may affect policy requirements regarding separation of duties. An attack on systems may have resulted in the implantation of a Trojan horse program, potentially exposing private user information, such as credit card information and financial data. In all of these cases, an undesirable situation must be rectified as quickly as possible and controls returned to normal operations.
The following answers are incorrect:
Deterrent - Deterrent controls are intended to discourage a potential attacker
Corrective - Corrective control fixes components or systems after an incident has occurred
Recovery - Recovery controls are intended to bring the environment back to regular operations
The following reference(s) were/was used to create this question:
CISA Review Manual 2014 Page number 44 and Official ISC2 CISSP guide 3rd edition Page number 50 and 51
NEW QUESTION 403
What is the Maximum Tolerable Downtime (MTD):
- A. Maximum elapsed time required to move back to primary site a major disruption
- B. It is maximum delay businesses that can tolerate and still remain viable
- C. Maximum elapsed time required to complete recovery of application data
- D. Minimum elapsed time required to complete recovery of application data
Answer: B
Explanation:
"The MTD is the period of time a business function or process can remain interrupted before its ability to recover becomes questionable." Pg 678 Hansche: Official (ISC)2 Guide to the CISSP Exam
NEW QUESTION 404
......
CISSP Real Exam Questions and Answers FREE: https://www.easy4engine.com/CISSP-test-engine.html
2021 Realistic Verified Free ISC CISSP Exam Questions : https://drive.google.com/open?id=1UIvCPu9SycwfRStMYZBB5txAINI_XfYi
