Get ready to pass the CISSP Exam right now using our ISC Certification Exam Package
A fully updated 2021 CISSP Exam Dumps exam guide from training expert Pass4cram
NEW QUESTION 520
Within the realm of IT security, which of the following combinations best defines risk?
- A. Threat coupled with a vulnerability.
- B. Vulnerability coupled with an attack.
- C. Threat coupled with a breach of security.
- D. Threat coupled with a breach.
Answer: A
Explanation:
Explanation/Reference:
Explanation:
Risk is defined as "the probability of a threat agent exploiting a vulnerability and the associated impact".
The industry has different standardized methodologies when it comes to carrying out risk assessments.
Each of the individual methodologies has the same basic core components (identify vulnerabilities, associate threats, calculate risk values), but each has a specific focus. As a security professional it is your responsibility to know which is the best approach for your organization and its needs.
NIST developed a risk methodology, which is specific to IT threats and how they relate to information security risks. It lays out the following steps:
System characterization
Threat identification
Vulnerability identification
Control analysis
Likelihood determination
Impact analysis
Risk determination
Control recommendations
Results documentation
Incorrect Answers:
A: Threat coupled with a breach is not the definition of risk.
C: Vulnerability coupled with an attack is not the definition of risk.
D: Threat coupled with a breach of security is not the definition of risk.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 77-79
NEW QUESTION 521
It is a violation of the "separation of duties" principle when which of the following individuals access the software on systems implementing security?
- A. security administrator
- B. systems programmer
- C. security analyst
- D. systems auditor
Answer: B
Explanation:
Reason: The security administrator, security analysis, and the system auditor need
access to portions of the security systems to accomplish their jobs. The system programmer does
not need access to the working (AKA: Production) security systems.
Programmers should not be allowed to have ongoing direct access to computers running
production systems (systems used by the organization to operate its business). To maintain
system integrity, any changes they make to production systems should be tracked by the
organization's change management control system.
Because the security administrator's job is to perform security functions, the performance of non-
security tasks must be strictly limited. This separation of duties reduces the likelihood of loss that
results from users abusing their authority by taking actions outside of their assigned functional
responsibilities.
References:
OFFICIAL (ISC)2@ GUIDE TO THE CISSP@ EXAM (2003), Hansche, S., Berti, J., Hare, H.,
Auerbach Publication, FL, Chapter 5 - Operations Security, section 5.3,"Security Technology and
Tools," Personnel section (page 32).
KRUTZ, R. & VINES, R. The CISSP Prep Guide: Gold Edition (2003), Wiley Publishing Inc.,
Chapter 6: Operations Security, Separations of Duties (page 303).
NEW QUESTION 522
Which of the following is the MAIN reason for using configuration management?
- A. To reduce the number of changes
- B. To reduce errors during upgrades
- C. To provide centralized administration
- D. To provide consistency in security controls
Answer: D
NEW QUESTION 523
Which of the following techniques BEST prevents buffer overflows?
- A. Boundary and perimeter offset
- B. Variant type and bit length
- C. Code auditing
- D. Character set encoding
Answer: D
Explanation:
Explanation
Some products installed on systems can also watch for input values that might result in buffer overflows, but the best countermeasure is proper programming. This means use bounds checking. If an input value is only sup-posed to be nine characters, then the application should only accept nine characters and no more. Some languages are more susceptible to buffer overflows than others, so programmers should understand these issues, use the right languages for the right purposes, and carry out code review to identify buffer overflow vulnerabilities.
NEW QUESTION 524
Which of the following is a type of mandatory access control?
- A. User-directed access control
- B. Role-based access control
- C. Rule-based access control
- D. Lattice-based access control
Answer: C
Explanation:
Reference: pg 46 Krutz: CISSP Prep Guide: Gold Edition
NEW QUESTION 525
Risk analysis is MOST useful when applied during which phase of the system development process?
- A. System Design Specification
- B. Project initiation and Planning
- C. Functional Requirements definition
- D. Development and Implementation
Answer: B
Explanation:
Explanation/Reference:
Explanation:
The Systems Development Life Cycle (SDLC), also called the Software Development Life Cycle or simply the System Life Cycle, is a system development model. There are many variants of the SDLC, but most follow (or are based on) the National Institute of Standards and Technology (NIST) SDLC process.
NIST Special Publication 800-14 states: "Security, like other aspects of an IT system, is best managed if planned for throughout the IT system life cycle. There are many models for the IT system life cycle but most contain five basic phases: initiation, development/acquisition, implementation, operation, and disposal." Additional steps are often added, most critically the security plan, which is the first step of any SDLC.
The following overview is summarized from the NIST document, in which the first two steps relate to Risk analysis:
1. Prepare a Security Plan-Ensure that security is considered during all phases of the IT system life cycle, and that security activities are accomplished during each of the phases.
2. Initiation-The need for a system is expressed and the purpose of the system is documented.
3. Conduct a Sensitivity Assessment-Look at the security sensitivity of the system and the information to be processed.
4. Development/Acquisition
5. Implementation
6. Operation/Maintenance
Incorrect Answers:
B: Risk analysis is not a critical part of the Functional Requirements definition.
C: Risk analysis is not a critical part of the System Design Specification.
D: Risk analysis is not a critical part of Development and Implementation.
References:
Conrad, Eric, Seth Misenar and Joshua Feldman, CISSP Study Guide, 2nd Edition, Syngress, Waltham,
2012, pp. 182-183
NEW QUESTION 526
When referring to the data structures of a packet, the term Protocol Data Unit (PDU) is used, what is the proper term to refer to a single unit of TCP data at the transport layer?
- A. TCP frame.
- B. TCP packet.
- C. TCP datagram.
- D. TCP segment.
Answer: D
Explanation:
A TCP Segment is the group of TCP data tramsmitted at the Transport Layer. TCP
is segment based network technology.
The message is sent to the transport layer, where TCP does its magic on the data. The bundle of
data is now a segment. If the message is being transmitted over TCP, it is referred to as a
"segment."
Protocol Data Unit Layers
The following answers are incorrect:
TCP datagram. Is incorrect because a TCP datagram is only a distractor, IP datagram would be
the proper terminology. TCP is segment based network technology.
TCP frame. Is incorrect because a TCP frame is only a distractor, Ethernet Frame would be the
proper terminology. TCP is segment based network technology.
TCP packet. Is incorrect because a TCP packet is only a distractor. TCP is segment based network technology.
References(s) used for this question:
Wikipedia http://en.wikipedia.org/wiki/Transport_layer Wikipedia http://en.wikipedia.org/wiki/Transmission_Control_Protocol#TCP_segment_structure
TCP/IP Illustrated, Volume 1: The Protocols, Addison-Wesley, 1994, ISBN 0-201-63346-9. http://www.infocellar.com/networks/osi-model.htm
NEW QUESTION 527
Which of the following job functions MUST be separated to maintain data and application integrity?
- A. Applications development and systems analysis
- B. Scheduling and computer operations
- C. Production control and data control functions
- D. Systems development and systems maintenance
Answer: D
NEW QUESTION 528
Which of the following is NOT a form of computer/network surveillance?
- A. Use of CCTV cameras
- B. Keyboard monitoring
- C. Review of audit logs
- D. Use of network sniffers
Answer: A
Explanation:
CCTV cameras fall under the category of physical surveillance. Answers a and b are forms of active surveillance. These types of surveillance require an organizational policy informing the employees that the surveillance is being conducted. Additionally, warning banners describing the surveillance at log-on to a computer or network should be prominently displayed. These banners usually state that by logging on, the user acknowledges the warning and agrees to the monitoring. Answer "Review of audit logs" is a passive form of computer/network surveillance.
NEW QUESTION 529
A risk assessment report recommends upgrading all perimeter firewalls to mitigate a particular finding. Which of the following BEST supports this recommendation?
- A. The expected loss from the risk exceeds mitigation costs.
- B. The Annualized Loss Expectancy (ALE) approaches zero.
- C. The infrastructure budget can easily cover the upgrade costs.
- D. The inherent risk is greater than the residual risk.
Answer: A
NEW QUESTION 530
Which of the following is not a one-way hashing algorithm?
- A. MD2
- B. HAVAL
- C. SHA-1
- D. RC4
Answer: D
Explanation:
RC4 was designed by Ron Rivest of RSA Security in 1987. While it is officially termed "Rivest Cipher 4", the RC acronym is alternatively understood to stand for
"Ron's Code" (see also RC2, RC5 and RC6).
RC4 was initially a trade secret, but in September 1994 a description of it was anonymously posted to the Cypherpunks mailing list. It was soon posted on the sci.crypt newsgroup, and from there to many sites on the Internet. The leaked code was confirmed to be genuine as its output was found to match that of proprietary software using licensed
RC4. Because the algorithm is known, it is no longer a trade secret. The name RC4 is trademarked, so RC4 is often referred to as ARCFOUR or ARC4 (meaning alleged RC4) to avoid trademark problems. RSA Security has never officially released the algorithm; Rivest has, however, linked to the English Wikipedia article on RC4 in his own course notes. RC4 has become part of some commonly used encryption protocols and standards, including
WEP and WPA for wireless cards and TLS.
The main factors in RC4's success over such a wide range of applications are its speed and simplicity: efficient implementations in both software and hardware are very easy to develop.
The following answer were not correct choices:
SHA-1 is a one-way hashing algorithms. SHA-1 is a cryptographic hash function designed by the United States National Security Agency and published by the United States NIST as a U.S. Federal Information Processing Standard. SHA stands for "secure hash algorithm".
The three SHA algorithms are structured differently and are distinguished as SHA-0, SHA-
1, and SHA-2. SHA-1 is very similar to SHA-0, but corrects an error in the original SHA hash specification that led to significant weaknesses. The SHA-0 algorithm was not adopted by many applications. SHA-2 on the other hand significantly differs from the SHA-
1 hash function.
SHA-1 is the most widely used of the existing SHA hash functions, and is employed in several widely used security applications and protocols. In 2005, security flaws were identified in SHA-1, namely that a mathematical weakness might exist, indicating that a stronger hash function would be desirable. Although no successful attacks have yet been reported on the SHA-2 variants, they are algorithmically similar to SHA-1 and so efforts are underway to develop improved alternatives. A new hash standard, SHA-3, is currently under development - an ongoing NIST hash function competition is scheduled to end with the selection of a winning function in 2012.
SHA-1 produces a 160-bit message digest based on principles similar to those used by
Ronald L. Rivest of MIT in the design of the MD4 and MD5 message digest algorithms, but has a more conservative design.
MD2 is a one-way hashing algorithms. The MD2 Message-Digest Algorithm is a cryptographic hash function developed by Ronald Rivest in 1989. The algorithm is optimized for 8-bit computers. MD2 is specified in RFC 1319. Although MD2 is no longer considered secure, even as of 2010 it remains in use in public key infrastructures as part of certificates generated with MD2 and RSA.
Haval is a one-way hashing algorithms. HAVAL is a cryptographic hash function. Unlike
MD5, but like most modern cryptographic hash functions, HAVAL can produce hashes of different lengths. HAVAL can produce hashes in lengths of 128 bits, 160 bits, 192 bits, 224 bits, and 256 bits. HAVAL also allows users to specify the number of rounds (3, 4, or 5) to be used to generate the hash.
The following reference(s) were used for this question:
SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000.
and
https://en.wikipedia.org/wiki/HAVAL
and
https://en.wikipedia.org/wiki/MD2_%28cryptography%29
and
https://en.wikipedia.org/wiki/SHA-1
NEW QUESTION 531
In which of the following cloud computing service model are applications hosted by the service provider and made available to the customers over a network?
- A. Software as a service
- B. Infrastructure as a service
- C. Data as a service
- D. Platform as a service
Answer: A
Explanation:
Software as a Service (SaaS) is a software distribution model in which applications are hosted by a vendor or service provider and made available to customers over a network, typically the Internet. SaaS is closely related to the ASP (application service provider) and on demand computing software delivery models.
For your exam you should know below information about Cloud Computing:
Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model promotes availability and is composed of five essential characteristics, three service models, and four deployment models.
Cloud Computing Image Reference http://osarena.net/wp-content/uploads/2013/04/cloud-computing3.jpg
Cloud computing service model Cloud computing service models
Image Reference http://www.esri.com/news/arcwatch/0110/graphics/feature2.jpg
Software as a Service (SaaS)
Software as a Service (SaaS) is a software distribution model in which applications are hosted by a vendor or service provider and made available to customers over a network, typically the Internet.SaaS is closely related to the ASP (application service provider) and on demand computing software delivery models. IDC identifies two slightly different delivery models for SaaS. The hosted application management (hosted AM) model is similar to ASP: a provider hosts commercially available software for customers and delivers it over the Web. In the software on demand model, the provider gives customers network-based access to a single copy of an application created specifically for SaaS distribution.
Provider gives users access to specific application software (CRM, e-mail, games). The provider gives the customers network based access to a single copy of an application created specifically for SaaS distribution and use.
Benefits of the SaaS model include: easier administration automatic updates and patch management
compatibility: All users will have the same version of software.
easier collaboration, for the same reason
global accessibility.
Platform as a Service (PaaS)
Platform as a Service (PaaS) is a way to rent hardware, operating systems, storage and network
capacity over the Internet. The service delivery model allows the customer to rent virtualized
servers and associated services for running existing applications or developing and testing new
ones.
Cloud providers deliver a computing platform,which can include an operating system, database,
and web server as a holistic execution environment. Where IaaS is the "raw IT network," PaaS is
the software environment that runs on top of the IT network.
Platform as a Service (PaaS) is an outgrowth of Software as a Service (SaaS), a software
distribution model in which hosted software applications are made available to customers over the
Internet. PaaS has several advantages for developers. With PaaS, operating system features can
be changed and upgraded frequently. Geographically distributed development teams can work
together on software development projects. Services can be obtained from diverse sources that
cross international boundaries. Initial and ongoing costs can be reduced by the use of
infrastructure services from a single vendor rather than maintaining multiple hardware facilities that
often perform duplicate functions or suffer from incompatibility problems. Overall expenses can
also be minimized by unification of programming development efforts.
On the downside, PaaS involves some risk of "lock-in" if offerings require proprietary service
interfaces or development languages. Another potential pitfall is that the flexibility of offerings may
not meet the needs of some users whose requirements rapidly evolve.
Infrastructure as a Service (IaaS)
Cloud providers offer the infrastructure environment of a traditional data center in an on-demand
delivery method. Companies deploy their own operating systems, applications, and software onto
this provided infrastructure and are responsible for maintaining them.
Infrastructure as a Service is a provision model in which an organization outsources the equipment
used to support operations, including storage, hardware, servers and networking components. The
service provider owns the equipment and is responsible for housing, running and maintaining it.
The client typically pays on a per-use basis.
The following answers are incorrect:
Data as a service - Data Provided as a service rather than needing to be loaded and prepared on
premises.
Platform as a service - Platform as a Service (PaaS) is a way to rent hardware, operating systems,
storage and network capacity over the Internet. The service delivery model allows the customer to
rent virtualized servers and associated services for running existing applications or developing and
testing new ones.
Infrastructure as a service - Infrastructure as a Service is a provision model in which an
organization outsources the equipment used to support operations, including storage, hardware,
servers and networking components. The service provider owns the equipment and is responsible
for housing, running and maintaining it. The client typically pays on a per-use basis.
The following reference(s) were/was used to create this question:
CISA review manual 2014 page number 102
Official ISC2 guide to CISSP 3rd edition Page number 689
http://searchcloudcomputing.techtarget.com/definition/Software-as-a-Service
http://searchcloudcomputing.techtarget.com/definition/Platform-as-a-Service-PaaS
http://searchcloudcomputing.techtarget.com/definition/Infrastructure-as-a-Service-IaaS
NEW QUESTION 532
Macro viruses infect what type of files.
- A. E-mail messages
- B. Linux Kernel files
- C. Web browsers
- D. Mail servers
- E. Microsoft office files
Answer: E
Explanation:
Macro viruses infect Microsoft office files. There are many macro viruses because the macro language is easy to use and because Microsoft Office is prolific.
NEW QUESTION 533
What is the MOST critical factor to achieve the goals of a security program?
- A. Capabilities of security resources
- B. Executive management support
- C. Effectiveness of security management
- D. Budget approved for security resources
Answer: B
NEW QUESTION 534
Which of the following is an essential step before performing Structured Query Language
(SQL) penetration tests on a production system?
- A. Verify countermeasures have been deactivated.
- B. Confirm warm site is ready to accept connections.
- C. Ensure firewall logging has been activated.
- D. Validate target systems have been backed up.
Answer: D
NEW QUESTION 535
Which of the following MUST be considered when developing business rules for a data loss prevention (DLP) solution?
- A. Data availability
- B. Data ownership
- C. Data sensitivity
- D. Data integrity
Answer: C
NEW QUESTION 536
What does a Synchronous (SYN) flood attack do?
- A. Forces Transmission Control Protocol /Internet Protocol (TCP/IP) connections into a reset state
- B. Empties the queue of pending Transmission Control Protocol /Internet Protocol (TCP/IP) requests
- C. Establishes many new Transmission Control Protocol / Internet Protocol (TCP/IP) connections
- D. Exceeds the limits for new Transmission Control Protocol /Internet Protocol (TCP/IP) connections
Answer: D
Explanation:
Section: Communication and Network Security
NEW QUESTION 537
Most of unplanned downtime of information systems is attributed to which of the following?
- A. Hardware failure
- B. Software failure
- C. Human error
- D. Natural disaster
Answer: A
Explanation:
This is what the static's says. Most of the downtime is cause of unexpected hardware failure. Commonly you just replace the FRU (Field replazable unit) when they fail.
Usually a well written software does not fail if the hardware is running correctly. The human errors are controllable and natural disasters are not very often. Hardware failure is very common, it's a good practice to have spare disks, NIC and any other hardware FRU's in your company to minimize the downtime with quick replacements.
NEW QUESTION 538
In the Capability Maturity Model (CMM) for software, the definition
describes the range of expected results that can be achieved by
following a software process is that of:
- A. Software process performance
- B. Software process maturity
- C. Structured analysis/structured design (SA/SD)
- D. Software process capability
Answer: D
Explanation:
A software process is a set of activities, methods, and practices that are used to develop and maintain software and associated products.
Software process capability is a means of predicting the outcome of the next software project conducted by an organization.
* Answer software process performance, is the result achieved by following a software process. Thus, software capability is aimed at expected results while software performance is focused on results that have been achieved.
*Software process maturity is the extent to which a software process is:
Defined
Managed
Measured
Controlled
Effective
Software process maturity, then, provides for the potential for
growth in capability of an organization. An immature organization
develops software in a crisis mode, usually exceeds budgets and
time schedules, and software processes are developed in an ad hoc
fashion during the project. In a mature organization, the software
process is effectively communicated to staff, the required processes
are documented and consistent, software quality is evaluated, and
roles and responsibilities are understood for the project.
Answer SA/SD is a distracter.
NEW QUESTION 539
......
Master 2021 Latest The Questions ISC Certification and Pass CISSP Real Exam!: https://www.pass4cram.com/CISSP_free-download.html
Practice To CISSP - Pass4cram Remarkable Practice On your Certified Information Systems Security Professional Exam: https://drive.google.com/open?id=1RtDLwhwubBnogSS7-J28BqpUcp179Uuq