CISSP - 3

Question 1

The help desk is receiving many calls regarding slow web application response times today. This is impairing business. The Systems Administrator notices an increased level of connection attempt failures. This scenario could be a failure of which penetration testing stage? A. Analysis and reporting B. Vulnerability detection C. Planning and preparation D. Information Gathering

Answer 1

C. Planning and preparation

Question 2

What is the primary reason a company would choose to perform a vulnerability assessment compared to a penetration test? A. Vulnerability assessments reveal a higher number of vulnerabilities B. Vulnerability assessments are less likely to disrupt production systems C. Vulnerability assessments are less time consuming and cost effective D. Vulnerability assessments help meet industry regulatory requirements

Answer 2

B. Vulnerability assessments are less likely to disrupt production systems

Question 3

A security practioner has a report that details the access list for a fileshare. This list is quite long. What next steps should the Security Practioner take with this list? A. review this list with the Human Resources Manager B. review this list with the Systems Administrator C. review this list with the Data Owner D. review this list with the Network Manager

Answer 3

C. review this list with the Data Owner

Question 4

When investigating a potential data breach by unauthorized access, the best source of information related to the activity can be found in A. Audit logs B. Performance logs C. traffic logs D. utilization logs

Answer 4

A. Audit logs

Question 5

Which one of the following introduces a weakness with end-to-end encryption? A. Non-printable characters B. ASCII codes C. Private Keys D. Application Gateways

Answer 5

D. Application Gateways

Question 6

Major security concern for SCADA systems using DLP3 protocols should be A. Spoofing B. Eavesdropping C. Denial of Service D. Man-in-the-middle

Answer 6

A. Spoofing

Question 7

Information security is the responsibility of A. everyone in the organization B. corporate management C. the corporate security office D. everyone with computer access

Answer 7

A. everyone in the organization

Question 8

Which of the following should an organization have in place to prevent employees from stealing intellectual property? A. Employee insurance plan and policies B. Employee training program and policies C. Employment agreement and policies D. Employee development plan and policies

Answer 8

C. Employment agreement and policies

Question 9

External technical attacks against systems often begin with A. Vulnerability Scans B. Social Engineering C. Monitoring of SSL traffic D. Analysis of degaussed media

Answer 9

B. Social Engineering

Question 10

Which of the following is the most appropriate to conduct the testing stage of a Software Development Life Cycle? A. Quality Assurance Staff B. Implementation Staff C. Security Staff D. Technical Support Staff

Answer 10

B. Implementation Staff

Question 11

Which of the following logs can track all applications on a system? A. Accounting log B. Kernel log C. System log D. Error log

Answer 11

C. System log

Question 12

The technical Service required for assuring the most important detail of this transaction is A. Diffie-Hellman Key exchange B. Kerberos authentication C. non-repudiation D. one-time pad

Answer 12

C. non-repudiation

Question 13

What is certificate path validation? A. Verification of the integrity of the associated root certificate B. verification of the validity of all certificates of the certificate chain to the root certificate C. verification of the integrity of the concerned private key D. verification of the revocation status of the concerned certificate

Answer 13

B. verification of the validity of all certificates of the certificate chain to the root certificate

Question 14

A security model provides the information security professional with a A. set of policies and procedures for the operations of a security program B. framework of security objectives and goals C. group of informal access controls to protect network resources D. list of recurring activities that test security preparedness

Answer 14

B. framework of security objectives and goals

Question 15

Where would be the most effective place to implement a host-based intrusion detection system? A. Firewall B. World Wide Web Server C. Edge router D. External Network Intrusion Detection SYstem

Answer 15

C. Edge router

Question 16

A security incident is an organization should be treated as A. an information technology issue B. a business issue C. a legal issue D. a computer security issure

Answer 16

B. a business issue

Question 17

Part of the patch deployement strategy includes A. Vendor responsiveness B. installing multiple patches to reduce outages C. proposing changes through change control D. exploit testing

Answer 17

C. proposing changes through change control

Question 18

When conducting a buisness impact analysis, who must be consulted when determining Maximum tolerable downtime for any particular organization’s system? A. Information Systems Security Officer B. Backup operations manager C. Business Contuity manager D. Manager of the affected business unit

Answer 18

D. Manager of the affected business unit

Question 19

An organization’s Business Continuity Plan team determines that an earthquake should cause 25 percent of its data center to be destroyed. The BCP team has just calculated the A. Exposure factor B. Single loss expectancy C. Annual loss expectancy D. Annual rate of occurrence

Answer 19

A. Exposure factor

Question 20

Identity Theft is primarily used to A. perform industrial espionage B. spook Internet Protocol addresses C. compromise security associations D. make unauthorized charges to accounts

Answer 20

D. make unauthorized charges to accounts

Question 21

The export of cryptographic technologies must comply with the A. international economic treaties B. entities of import and exports C. entity and country of export D. local laws of the country of export

Answer 21

C. entity and country of export

Question 22

When addressing built-in redundancy with the skyscraper, which of the following must be addressed? A. integrity of the building materials used B. energy efficiency of the building materials used C. load balancing with structural supports D. redundancy in structural components

Answer 22

D. redundancy in structural components

Question 23

The use of automated environment systems can help A. control overheating electronics B. control heat loss of sensitive equipment C. increase power fluctuations D. decrease reliance on closed circuit television

Answer 23

A. control overheating electronics

Question 24

Which type of fire extinguisher is best suited for use in a data center and computer room environments where the primary fire risk is from electrical fires? A. Type A B. Type B C. Type C D. Type D

Answer 24

C. Type C

Question 25

What is the most effective way to prevent theft of a laptop A. install a radio frequency indentification tracking B. encrypt teh hard drive C. attach a lock cable D. do not leave unattended

Answer 25

D. do not leave unattended