CISSP CBK Review Seminar -- Domains 1 & 2

Question 1

3. International Organization for Standardization (ISO) standard 27002 provides guidance for vendor compliance by outlining

(A) guidelines and practices of security controls.
(B) financial soundness and business viability metrics.
(C) standard best practice for procurement policy.
(D) contract agreement writing standards.

Answer 1

(A) guidelines and practices of security controls.

Question 2

8. Which of the following is an industry specific standard that PRIMARILY deals with privacy matters?

(A) Control Objectives for Information and Related Technology (COBIT)
(B) European Union Principles
(C) International Organization for Standardization (ISO) 9001:2000
(D) The Wassenaar Agreement

Answer 2

(B) European Union Principles

Question 3

12. Which of the following defines the intent of a system security policy?

(A) A description of the settings that will provide the highest level of security
(B) A brief high-level statement defining what is and is not permitted in the operation of the system
(C) A definition of those items that must be denied on the system
(D) A listing of tools and applications that will be used to protect the system

Answer 3

(B) A brief high-level statement defining what is and is not permitted in the operation of the system

Question 4

19. Which of the following is the BEST reason for using an automated risk analysis methodology?

(A) Automated methodologies generally require minimal training and knowledge of risk analysis.
(B) Most software tools have user interfaces that are easy to use and require little or no computer experience.
(C) Minimal information gathering is required due to the amount of information built into the software tool.
(D) Much of the data gathered during the review can be reused, greatly reducing the time required to perform a subsequent analysis.

Answer 4

(D) Much of the data gathered during the review can be reused, greatly reducing the time required to perform a subsequent analysis.

Question 5

26. An organizational information security strategy is incomplete without

(A) recommendations for salary improvement of security professionals.
(B) addressing privacy and health care requirements of employees.
(C) alignment with organizational audit and marketing plans.
(D) incorporating input from organizational privacy and safety professionals.

Answer 5

(D) incorporating input from organizational privacy and safety professionals.

Question 6

33. The organizational information security plan can

(A) assure protection of organizational data and information.
(B) select the technology solutions to enhance organizational security
effectiveness.
(C) identify potential risks to organizational employee behavior.
(D) align organizational data protection schemes to business goals.

Answer 6

(D) align organizational data protection schemes to business goals.

Question 7

60. Verifying vendor compliance with their active security policies is typically provided through

(A) indemnification clauses.
(B) unqualified vendor management reports.
(C) good faith agreements.
(D) audit and standards compliance reporting.

Answer 7

(D) audit and standards compliance reporting.

Question 8

61. What is the MOST critical factor to the success of enterprise security?

(A) Ability to effectively monitor the enterprise
(B) Budget available for security department
(C) Senior management support
(D) Complete security awareness plans

Answer 8

(C) Senior management support

Question 9

67. Which one of the following individuals has PRIMARY responsibility for determining the classification level of information?

(A) Security manager
(B) User
(C) Owner
(D) Auditor

Answer 9

(C) Owner

Question 10

69. When a communication link is subject to monitoring, what advantage does end- to-end encryption have over link encryption?

(A) Cleartext is only available to the sending and receiving processes.
(B) Routing information is included in the message transmission protocol.
(C) Routing information is encrypted by the originator.
(D) Each message has a unique encryption key.

Answer 10

(A) Cleartext is only available to the sending and receiving processes.

Question 11

70. Computer security is the responsibility of

(A) everyone in the organization.
(B) corporate management.
(C) the corporate security staff.
(D) everyone with computer access.

Answer 11

(A) everyone in the organization.

Question 12

72. What is the PRIMARY objective for implementing a security awareness program?

(A) To reduce the cost associated with security tools
(B) To ensure users are aware of security policies and their responsibilities
(C) To reduce the risk of social engineering
(D) To obtain the support of users when investigating security breaches

Answer 12

(B) To ensure users are aware of security policies and their responsibilities

Question 13

75. Employee involuntary termination processing should include

(A) a list of all passwords used by the individual.
(B) a report on outstanding projects.
(C) the surrender of any company identification.
(D) the signing of a Non-Disclosure Agreement (NDA).

Answer 13

(C) the surrender of any company identification.

Question 14

82. What is the company benefit, in terms of risk, for people taking a vacation of a specified minimum length?

(A) Reduces stress levels, thereby lowering insurance claims
(B) Improves morale, thereby decreasing errors
(C) Increases potential for discovering frauds
(D) Reduces dependence on critical individuals

Answer 14

(C) Increases potential for discovering frauds

Question 15

84. The International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) standard 27002 documents which body of knowledge?

(A) Information security management
(B) Personally identifiable health information data management
(C) Credit card handling processes
(D) Software development best practices

Answer 15

(A) Information security management

Question 16

87. Which one of the following is the MOST crucial link in the computer security chain?

(A) Access controls
(B) People
(C) Management
(D) Awareness programs

Answer 16

(B) People

Question 17

88. During a routine investigation of violation reports, a technician discovers a memorandum written to a competitor containing sensitive information about the technician’s company. Based on the (ISC)2 Code of Ethics, what is the FIRST action the technician should take?

(A) Delete the memorandum to ensure no one else will see it
(B) Contact the author of the memorandum to let them know of the discovery
(C) Immediately inform the company’s management of the technician’s
findings and the potential risk
(D) Launch a training program outlining the need for protection of intellectual
property

Answer 17

(C) Immediately inform the company’s management of the technician’s
findings and the potential risk

Question 18

89. When dealing with intellectual property rights for software between nations, it is important to consider

(A) information concerning the overall foreign trade agreements between the two nations.
(B) the governing law in the agreements between the two nations.
(C) foreign corrupt trading practices in the agreement between the two
nations.
(D) information about the specific product liabilities that the software has.

Answer 18

(B) the governing law in the agreements between the two nations.

Question 19

91. A critical step in the Business Impact Analysis (BIA) is to

(A) document application vulnerabilities.
(B) create a vendor contact list.
(C) identify acceptable recovery times.
(D) determine if a warm or hot site will be used.

Answer 19

(C) identify acceptable recovery times.

Question 20

92. Which of the following is the MOST important information to consider when writing a security policy?

(A) The impact on the organization’s ability to achieve its goals.
(B) The acceptance by members of the IT department.
(C) The effect it could have on organizational morale.
(D) The degree to which it may affect the Business Continuity Plan (BCP).

Answer 20

(A) The impact on the organization’s ability to achieve its goals.

Question 21

99. In order to reduce the costs and complexity of providing fault tolerant processor services, a certain number of the most recent transactions are allowed to be lost during the recovery. The magnitude of this loss is specified in the

(A) Recovery Point Objective (RPO).
(B) Recovery Time Objective (RTO).
(C) Return to Access Objective
(D) Annualized Loss Expectancy (ALE).

Answer 21

(A) Recovery Point Objective (RPO).

Question 22

101. Which of the following is MOST true about Management’s overarching security policy.

(A) It details the organization’s security plan.
(B) It directly reflects management’s commitment to security.
(C) It should be published so it can be read.
(D) Copies should be controlled for easy of updating, accountability purposes, auditing, and to demonstrate management’s commitment to security

Answer 22

(B) It directly reflects management’s commitment to security.

Question 23

102. All of the following are basic components of a security policy EXCEPT the

(A) Definition of the issue being addressed and relevant terms.
(B) Statement of roles and responsibilities.
(C) Statement of applicability and compliance requirements.
(D) Statement of performance characteristics and requirements.

Answer 23

(D) Statement of performance characteristics and requirements.

Question 24

103. Which of the following provides for an effective security program?

(A) An hierarchical definition of security policies, standards, and procedures
(B) The identification, assessment, and mitigation of vulnerabilities
(C) A definition of program modules and procedures for data structures
(D) The identification of organizational, procedural, and administrative weaknesses

Answer 24

(A) An hierarchical definition of security policies, standards, and procedures

Question 25

104. Which one of the following risk analysis terms characterizes the absence or weakness of a risk-reducing safeguard?

(A) Threat
(B) Probability
(C) Vulnerability
(D) Loss expectancy

Answer 25

(C) Vulnerability

Question 26

111. Non-binding statements on how to achieve compliance with protective standards are called:

(A) Policies if signed by the Chief Information Officer (CIO).
(B) Standards, but only if issued by an International Organization.
(C) Guidelines if they provide “Best Practices.”
(D) Procedures if they are properly written.

Answer 26

(C) Guidelines if they provide “Best Practices.”

Question 27

112. You are the Chief Information Security Officer for the United Nations. Understanding the International challenges will be difficult. However, which of the following will have the LEAST impact on your decision-making during risk analysis?

(A) Cost/benefit analysis
(B) Deploying safeguards
(C) Auditing
(D) Selecting products from different International vendors.

Answer 27

(D) Selecting products from different International vendors.

Question 28

113. Which risk management methodology uses the exposure factor multiplied by the asset value to determine its outcome?

(A) Annualized Loss Expectancy
(B) Single Loss Expectancy
(C) Annualized Rate of Occurrence
(D) Information Security Risk Management

Answer 28

(B) Single Loss Expectancy

Question 29

118. A large number of approved waivers to an organization’s policy may indicate:

(A) that the policy is too general.
(B) that that the policy is being enforced.
(C) that the policy is inappropriate for the organization or situation.
(D) that the waiver process is not properly processing the waivers.

Answer 29

(C) that the policy is inappropriate for the organization or situation.

Question 30

122. CISSPs may be faced with an ethical conflict between their company’s policies and the (ISC)2 Code of Ethics. According to the (ISC)2 Code of Ethics, in which order of priority should ethical conflicts be resolved?

(A) Duty to principals, profession, public safety, and individuals
(B) Duty to protect society (public safety), Act honorable and legally (for the individual), provide diligent service to principals, and advance and protect the profession
(C) Duty to profession, public safety, individuals, and principals
(D) Duty to public safety, profession, individuals, and principals

Answer 30

(B) Duty to protect society (public safety), Act honorable and legally (for the individual), provide diligent service to principals, and advance and protect the profession

Question 31

123. Key elements of an information security program include

(A) Disaster recovery and business continuity planning, definition of access control requirements, and human resources policies.
(B) Business impact, threat and vulnerability analysis, delivery of an information security awareness program, and physical security of key installations.
(C) Security policy implementation, assignment of roles and responsibilities, and information asset classification.
(D) Senior management organizational structure, message distribution standards, and procedures for the operation of security management systems.

Answer 31

(C) Security policy implementation, assignment of roles and responsibilities, and information asset classification.