CISSP - 6

Question 1

The three implementable classifications of access control are administrative, physical and A. detective B. preventive C. reactive D. technical

Answer 1

D. technical

Question 2

What type of assessment tests the ability of an organization to know who, what, where, and when devices are connected to the network? A. Infrastructure B. Initial technical C. Access control D. Change impact

Answer 2

C. Access control

Question 3

Which of the following is the primary benefit of deploying a Single Sign solution? A. Improved account maintenance B. reduced account synchronization C. reduced password fatigue D. increased password complexity?

Answer 3

C. reduced password fatigue

Question 4

At which layer in the Open Systems Interconnection Reference Model does encryption and decryption take place? A. Presentation B. Application C. Session D. Transport

Answer 4

A. Presentation

Question 5

How does a router determine the network address for a packet with destination address of 10.21.41.3? A. Extracts the port number in the IP header B. Uses the Internet Control Message Protocol C. Locates the last two segments of the IP address D. Calculates it from the IP address and subnet mask

Answer 5

D. Calculates it from the IP address and subnet mask

Question 6

Man in the middle attacks are facilitated through A. snarfing B. spoofing C. spamming D. SYN flooding

Answer 6

B. spoofing

Question 7

A database programmer’s faulty program automatically altered some database parameters of an organization’s confidential information. What security principle was violated by this? A. confidentiality B. integrity C. availability D. non-repudiation

Answer 7

B. integrity

Question 8

Out of the following, what type of information requires the utmost protection in an organization A. public B. confidential C. internal use only D. restricted

Answer 8

D. restricted

Question 9

The cost aspect of risk, typically associated with some type of loss, is known as a threat’s A. rating B. impact C. likelihood D. class

Answer 9

B. impact

Question 10

When purchasing proprietary software from a vendor, source code escrow is best used to protect against A. system data loss B. vendor bankruptcy C. copyright violation D. legal liability

Answer 10

B. vendor bankruptcy

Question 11

Which of the following vulnerabilities can be triggered by aggregation? A. privilege escalation B. structured query language injection C. cross site scripting D. forceful browsing

Answer 11

A. privilege escalation

Question 12

When a financial transaction is digitally signed, which of the following additional safeguards can be used to prevent the same transaction from being processed again? A. include a timestamp in the message B. include a message authentication code C. encrypt the entire message excluding the digital signature D. encrypt the entire message including the digital signature

Answer 12

A. include a timestamp in the message

Question 13

A hash function is used in the signature generation process to obtain a condensed version of the data to be signed; the condensed version of the data is often called a A. message digest B. public key C. data security standard D. encrypted payload

Answer 13

A. message digest

Question 14

Data encryption as a method of protecting data A. requires good key management B. is easily administered C. is not resource intensive D. is the cheapest way to protect data

Answer 14

A. requires good key management

Question 15

Which of the following statements best describes steganography? A. the plain text input is converted to a cipher B. intent to protect data in its entirety C. intent to hide data in its entirety D. the plain text input is converted to a hashed output

Answer 15

C. intent to hide data in its entirety

Question 16

A major advantage of an expert system is that A. it is an objective and complete response for a given set of facts at all times B. it emulates problem solving behavior of a single subject matter expert C. the inferences for a given set of facts can be changed D. it is a low cost alternative to employing a human expert

Answer 16

A. it is an objective and complete response for a given set of facts at all times

Question 17

Which of the following is effective to preventing cross site scripting attacks? A. add a challenge/response to the webform B. disable java script C. disable active X D. Use Advanced Encryption standard

Answer 17

B. disable java script

Question 18

The information security incident response team is primarily concerned with A. handling information security incidents B. implementing safeguards to avoid security incidents C. executing penetration tests to detect systems vulnerabilities D. ensuring that all applications are properly patched

Answer 18

A. handling information security incidents

Question 19

Software that can covertly capture personal information stored on or typed into a computer is commonly called A. spyware B. shovelware C. adware D. foistware

Answer 19

A. spyware

Question 20

Monitoring and capturing wireless signals provides a hacker with what significant advantage? A. defeats the tempest safeguards B. bypasses the security built into the target application C. gathers information or data without physical trespass D. compromise wired equivalent privacy security

Answer 20

C. gathers information or data without physical trespass

Question 21

As part of a BCP, electronic business data must be A. transported in an approved container B. retained for an indefinite period C. stored in a usable format D. recorded in a least three locations

Answer 21

C. stored in a usable format

Question 22

Which of the following is the best trigger for an organization to review its BCP/DRP? A. procurement of new assets B. when a new security practitioner is assigned C. operating system patch update D. mail deliveries

Answer 22

A. procurement of new assets

Question 23

What convention provides a minimum level of international copyright protection? A. The Paris convention B. The Berne convention C. The Madrid Agreement D. The World Intellectual Property Organization

Answer 23

B. The Berne convention

Question 24

When developing plans to build a new facility or to relocate a business unit to another site, security considerations would incorporate A. third party security design solutions B. political agendas C. industry standards D. crime prevention through environmental design

Answer 24

D. crime prevention through environmental design

Question 25

Which device is best for making tailgating attacks impossible and can be installed to detect and record number of person’s entering and leaving a building A. cameras B. cipher locks with card swipe C. biometric scanning D. mantrap

Answer 25

D. mantrap