CISSP - 2 Flashcards
Which of the following is considered unacceptable for access control? A. Voice pattern systems B. Signature dynamics systems C. Fingerprint systems D. Retina pattern systems
B. Signature dynamics systems
Which of the following is an information owner’s responsibility? A. Establishing a formal audit process for determining ownership B. Establishing the criteria for classifying the data based on the business function C. Conducting awareness training relating to the criticality of assigning ownership D. Reviewing and confirming that the authorization process is working as defined
D. Reviewing and confirming that the authorization process is working as defined
A detective control includes what type of function? A. Intrusion B. Logging C. Alarm D. Cut-off
B. Logging
Secure Sockets Layer exists between the A. HTTP browser and the Application Layer B. Software application and the Presentation Layer C. Transport Layer and the Application Layer D. Certificate Server and Authentication Authority
C. Transport Layer and the Application Layer
Access Server Authentication A. are general purpose communication devices B. are implemented primarily on mainframes C. use Kerberos for a single sign on D. are freestanding hardware devices
A. are general purpose communication devices
Which factor primarily drives the security manager’s budgeting decisions? A. Alignment with organizational objectives B. Effectiveness of security technologies C. Scarcity of security resources D. Knowledge of future risks
A. Alignment with organizational objectives
Metrics for tracking the improvement of a security program include the A. number of Denial of Service attacks B. quantity of new policies and procedures drafted C. percentage of successful external attack attempts D. Mean time to incident resolution
D. Mean time to incident resolution
During the Certification and Accreditation process for application software, the MOST important discovery is that A. The installed security measures are similar to the network controls and are not needed B. least privilege is implemented but not required C. the application was not adequately tested in production D. the installed security measures provide only a false sense of security
D. the installed security measures provide only a false sense of security
A vital feature to ensure the security of a program is known as A. type safety B. memory safety C. safe language D. safety pointer
B. memory safety
The primary goal of cryptanalysis is to A. decipher encrypted coded signals B. ensure that the key has no repeating segments C. reduce the system overhead for cryptographic functions D. determine the number of encryption permutations required
A. decipher encrypted coded signals
Your organization has decided to implement PKI. What service will this infrastructure provide to the organization? A. Nonrepudiation B. Availability C. Authorization D. Identification
A. Nonrepudiation
A problem with the International Common Criteria for Information Technology Security Evaluation is that A. it is limited in security functionality scope B. it is only used by the United States, Canada, Great Britain, and Australia C. It is very complicated to implement D. the certification process is extremely expensive
D. the certification process is extremely expensive
Which type of malware is unique to networked computers? A. Virus attacks B. Trojan horse attacks C. Worms D. Denial of Service attacks
C. Worms
What is the term used to describe a virus that can infect both program files and boot sectors? A. Polymorphic B. Multipartite C. Stealth D. Multiple encrypting
B. Multipartite
Which of the following is the MOST difficult to detect with anti-virus software? A. Worm B. Trojan horse C. Rootkit D. metamorphic virus
A. Worm
The primary goals of BIA are to A. develop a plan to mitigate threats to the organizational data and reduce the costs of recovery B. prioritize time-critical business processes and estimate their recovery time objectives C. evaluate and prioritize all potential threats to the organization D. document the existing business continuity practices for senior management and assign responsibility for COOP.
B. prioritize time-critical business processes and estimate their recovery time objectives
Which of the following are the phases to the recovery process? A. Continuation, resumption, restoration B. Planning, relocation, restoration C. Relocation, restoration. operation D. Resumption, continuation, operation
A. Continuation, resumption, restoration
Which of the following is one of the two major international copyright treaties? A. The Kyoto Protocol B. The Montreal Protocol C. The Berne Convention D. The Bali Convention
C. The Berne Convention
Which of the following should be included in a Privacy Impact Analysis? A. who is collection the data and when the data will be used B. what data will be collected and how the data will be used C. how the data will be shared and how data errors will be corrected D. how the data will be secured and the cost of securing the data
B. what data will be collected and how the data will be used
Which of the following is an explanation of the difference between compliance and audit? A. Compliance is the action of meeting information security objectives. Audit evaluates how those objectives are met B. Compliance is the action of meeting information security objectives. Audit specifies what those objectives should be C. Compliance is the action of evaluating information security objectives. Audit specifies what those objective should be D. Compliance is the action of specifying information security objectives. Audit evaluates how those objectives are met
A. Compliance is the action of meeting information security objectives. Audit evaluates how those objectives are met
When the use of a zoom lens is not practical ins CCTV installation, scene magnification can be achieved by A. increasing the field of view B. decreasing the camera sensor size C. increasing the monitor size D. decreasing the focal length of the lens
C. increasing the monitor size
Which of the following is the GREATEST concern a physical security manager has when implementing physical security technologies? A. maintenance of a single vendor-based solution B. communications between the technologies and the response team C. technical manuals for each of the implemented technologies D. end-user acceptance of the technology
D. end-user acceptance of the technology
What is the biggest advantage of using a locked cage in a data center? A. subdivide a large raised floor area B. circumvent the faulty card reader and help the system administrator to get to the equipment C. Provide a restrictive barrier within a server environment D. Allow people to look in and see what is going on
C. Provide a restrictive barrier within a server environment
What fire suppression system is chosen for computer facilities because it does not damage electronic equipment or harm humans? A. CO2 B. FM-200 C. Foam D. Heavy Water
B. FM-200
Which of the following represents the PRIMARY security vulnerability associated with e-mail cryptography using a symmetric algorithm? A. Public Key compromise B. Private Key compromise C. Clear text sessions D. Symmetric Methods
A. Public Key compromise
