CISSP certification: Full 125 question practice test #4 - test 2 (Anthony Today) Flashcards
Which historical type of encryption involved the sender switching letters a certain number of spots forwards or back in the alphabet, with the receiver doing the same in the opposite direction?
A. Spartan Scytale
B. Vigenere cipher
C. Caesar cipher
D. Bazeries
C. Caesar cipher
Explanation: Caesar Cipher (Substitution) - Done by switching letters a certain numbers of spots in the alphabet. “Pass the exam" moved 3 back would be “Mxpp qeb buxj.”
In our authentication process we are wanting to add a pseudo random number to ensure old data is not replayed. Which of these would we add?
A. Salting
B. Clipping levels
C. Nonce
D. Key-streching
C. Nonce
Explanation:
Nonce: (arbitrary number that may only be used once). It is often a random or pseudo-random number issued in an authentication protocol to ensure that old communications cannot be reused in replay attacks. They can also be useful as initialization vectors and in cryptographic hash function.
What would a distance vector routing protocol use to determine the BEST route to a certain destination?
A. The best bandwidth to the destination
B. The aggregated payload and the bandwidth
C. Least hops to the destination
D. The path it used last time it sent data to that destination
C. Least hops to the destination
Explanation:
Distance vector routing protocols: Only focuses on how far the destination is in Hops (how many routers in between here and there). Does not care about bandwidth, it just uses the shortest path.
Looking at our information security governance, who would approve and sign off on our policies?
A. Senior management
B. The IT Teams
C. IT Security
D. IT management
A. Senior management
Explanation:
Policies are mandatory, they are high level and non-specific. They are contain “Patches, updates, strong encryption”, but they will not be specific to “OS, encryption type, vendor technology”. They are approved and often written by senior management.
In which type of software testing do we progressively test larger and larger groups of software components until the software works as a whole?
A. Reference checking
B. Integration testing
C. Penetration testing
D. Unit testing
B. Integration testing
Explanation:
Integration testing: Seeks to verify the interfaces between components against a software design. Integration testing works to expose defects in the interfaces and interaction between integrated components/modules. Progressively larger groups of software components are tested until the software works as a system.
We have realized our current use of magnetic stripe ID cards is not matching the security profile senior management wants. What could we use on the cards in addition to the magnetic stripe to make them smart cards?
A. UV printing
B. RFID Chip
C. Holograms
D. RFII Chip
B. RFID Chip|
Explanation:
Smart Cards and tokens (contact or contactless): They contain a computer circuit using an ICC (Integrated Circuit Chip).
As part of our Business Continuity Plan (BCP) and its sub plans we want to ensure we are redundant. Which of these is something we want to be redundant on?
A. Internet connections
B. People
C. Power
D. All of the above
D. All of the above
Explanation:
We want layers of redundancy, just like we have defense in depth. We want power, internet, path, hardware, system, backup, people, etc. redundancy.
We are wanting to hire outside penetration testers. Who in our organization would set the goals for the penetration test?
A. IT security leadership
B. IT security team
C. IT leadership
D. Senior management
D. Senior management
Explanation: Penetration Testing (Pen Testing), often called Ethical Hacking. Test if the vulnerabilities are exploitable. An authorized simulated attack on our organization that looks for security weaknesses, potentially gaining access to the systems, buildings and data. Senior management set the goals for the Pen testing. Why are we doing it? What are we trying to achieve? They have to sign off on it.
There are many risks in today’s increasing complex IT world, how we deal with them should be part of an overarching strategy. We could for instance be risk neutral or averse. Who would decide our organization’s risk appetite?
A. The IT security team
B. Senior management
C. The IT leadership team
D. Rules and regulations
B. Senior management
Explanation:
Governance – This is C-level Executives (Not you). Stakeholder needs, conditions and options are evaluated to define: Balanced agreed-upon enterprise objectives to be achieved. Setting direction through prioritization and decision making. Monitoring performance and compliance against agreed-upon direction and objectives. Risk appetite – Aggressive, neutral, adverse.
We are wanting to strengthen our detective access controls. Which of these could be something we would want to implement?
A. Patches
B. Encryption
C. IDS
D. Backups
C. IDS
Explanation:
Detective: Controls that detect during or after an attack – IDS, CCTV, Alarms, anti-virus.
Which process are we using when we approve alterations to our environment?
A. Project management
B. Patch management
C. Implementation management
D. Change management
D. Change management
Explanation:
Change Management: Often called change control, a formalized process on how we handle changes to our environments. If done right we will have full documentation, understanding and we communicate changes to appropriate parties. The change review board should be comprised of both IT and other operational units from the organization, we may consider impacts on IT, but we are there to serve the organization, they need to understand how it will impact them and raise concerns if they have any. A change is proposed to the change board, they research to understand the full impact of the change. The person or group submitting the change should clearly explain the reasons for the change, the pro’s and con’s of implementing and not implementing, any changes to systems and processes they know about and in general aide and support the board with as much information as needed.
As an IT Security professional, you are expected to perform your due diligence. What does this mean?
A. Continue the security practices of your company
B. Do what is right in the situation and your job. Act on the knowledge
C. Apply patches annually
D. Researching and acquiring the knowledge to do your job right
D. Researching and acquiring the knowledge to do your job right
Explanation:
Due Diligence – The research to build the IT Security architecture of your organization. Best practices and common protection mechanisms. Research of new systems before implementing.
When we are using VoIP for our phone calls, which protocol does it use to transmit data?
A. UDP
B. RDP
C. DHCP
D. TCP
A. UDP
Explanation:
VoIP (Voice over Internet Protocol): The digital information is packetized, and transmitted using UDP IP packets over a packet-switched network.
We are restoring services and applications back from our DR site to our original site after a security incident. Which applications would we move back FIRST?
A. Least critical
B. The least resource intensive
C. Most critical
D. The most resource intensive
A. Least critical
Explanation:
The BCP team has sub-teams responsible for rescue, recovery and salvage in the event of a disaster or disruption. Salvage team (failback): Responsible for returning our full infrastructure, staff and operations to our primary site or a new facility if the old site was destroyed. We get the least critical systems up first, we want to ensure the new sites is ready and stable before moving the critical systems back.
Why would we want to keep a positive pressure in our data center?
A. To get contaminants in
B. We wouldnt, we would keep a neutral pressure
C. The keep contaminants out
D. We wouldnt we would keep a negative pressure
C. The keep contaminants out
Explanation:
In our data center we want to keep a positive pressure to keep contaminants out, this can be dust particles that can set of particle sensors and release FM200 or another fire suppressant gas.
We are already using usernames and passwords online. Which of these could be something else we would add to get multifactor authentication?
A. Single-use password
B. Security questions
C. Challenge response
D. PINs
A. Single-use password
Explanation:
Single-use passwords are possession factors, you don’t remember them you have them on a piece of paper or on a token, we have multifactor authentication with the username, password and single-use password.
When someone is using a fake ID, it is an attack on which type of authentication?
A. Type 3
B. Type 4
C. Type 2
D. Type 1
C. Type 2
Explanation:
Something you have - Type 2 Authentication (ID, Passport, Smart Card, Token, cookie on PC etc.).
If we have 100 users in our organization that are all needing to communicate securely with each other, would symmetric or asymmetric encryption use the highest number of encryption keys?
A. They would use the same number of keys
B. We would need more information to be able to tell
C. Asymmetric
D. Symmetric
D. Symmetric
Explanation:
Symmetric would use 4950 keys (100x(100-1))/2, asymmetric uses 2 keys per person so 200 keys.
Which type of black-box testing would we submit random malformed data as inputs into the software?
A. Fuzz testing
B. Dynamic testing
C. Static testing
D. Synthetic transaction testing
A. Fuzz testing
Explanation:
Fuzzing (Fuzz testing): Testing that provides a lot of different malformed inputs to try to cause unauthorized access or for the application to enter unpredictable state or crash. If the program crashes or hangs the fuzz test failed. The Fuzz tester can enter values into the script or use pre-compiled random or specific values.
Jane is talking to a friend and is explaining what digital signatures do. Which of these could be something that she tells her friend is one of the MAIN reasons we use digital signatures?
A. Integrity
B. Availability
C. Authentication
D. Confidentiality
A. Integrity
Explanation:
Digital Signatures: Provides Integrity and Non-Repudiation.
You can MOST LIKELY be held liable when you display which of these?
A. Negligence
B. Due Care
C, Remorse
D. Due diligence
A. Negligence
Explanation:
Negligence (and Gross Negligence) is the opposite of Due Care. If a system under your control is compromised and you can prove you did your Due Care you are most likely not liable. If a system under your control is compromised and you did NOT perform Due Care you are most likely liable.
Which type of audit could we use to ensure our employees are following our policies?
A. Review Management
B. White Box testing
C. Review user logs
D. Self reviews
C. Review user logs
Explanation:
We would want to review user logs to see if they are following our policies.
Bob is telling the senior leadership team about how we use RAID. The CFO wants to know what that is an abbreviation of.
A. Reversed Array of Inexpensive Disks
B. Recursive Array of Independent Disks
C. Redundant Array of Inexpensive Disks
D. Real Array of Inexpensive Disks
C. Redundant Array of Inexpensive Disks
Explanation:
Redundant Array of Independent Disks (RAID): Comes in 2 basic forms, disk mirroring and disk striping. Disk mirroring: Writing the same data across multiple hard disks, this is slower, the RAID controller has to write all data twice. Uses at least 2 times as many disks for the same data storage, needs at least 2 disks. Disk striping: Writing the data simultaneously across multiple disks providing higher write speed. Uses at least 2 disks, and in itself does not provide redundancy. We use parity with striping for the redundancy, often by XOR, if we use parity for redundancy we need at least 3 disks.
Our organization is considering different types of intellectual protection options. Which of these is something that can be patented?
A. Logos
B. Software
C. Inventions
D. Public Domain (CC0) photos
C. Inventions
Explanation:
Patents: Protects inventions for 20 years (normally) – Cryptography algorithms can be patented. Inventions must be:Novel (New idea no one has had before). Useful (It is actually possible to use and it is useful to someone). Nonobvious (Inventive work involved).
We are upgrading our documentation on the switch best practices we use in our organization.
Which of these should NOT be something you would find on that documentation?
A. Put all ports in specific VLANs
B. Use MAC sticky on ports
C. Make all ports trunk ports
D. Shut unused ports down
C. Make all ports trunk ports
Explanation:
Good switch security includes shut down unused ports, add mac-sticky and hardcode if ports are access or trunk ports. Making all ports trunk ports is a bad idea.
In implementing type 1 authentication, we could implement which of these? (Select all that apply).
A. Passwords B. PINs C. Tokens D. Pass phrases E. One-time passwords F. Biometrics
A. Passwords
B. PINs
D. Pass phrases
Explanation:
Something you know - Type 1 Authentication: Passwords, pass phrase, PIN etc., also called Knowledge factors. The subject uses these to authenticate their identity, if they know the secret, they must be who they say they are. This is the most commonly used form of authentication, and a password is the most common knowledge factor. The user is required to prove knowledge of a secret to authenticate.
When Bob’s workstation is requesting a new IP address from the Dynamic Host Configuration Protocol (DHCP) server, which well-known port would the DHCP client use?
A. 67
B. 22
C. 23
D. 68
D. 68
Explanation:
DHCP uses UDP Port 67 for the DHCP Server and UDP Port 68 for the Client.
Jane is working on strengthening our preventative controls. What could she look at to do that?
A. IDS
B. Drug Tests
C. Backups
D. Patches
B. Drug Tests
Explanation:
Preventative: Prevents action from happening – Least Privilege, Drug Tests, IPS, Firewalls, Encryption.
When collecting personal information about our employees and customers, how much should we collect?
A. Everything they enter as well as everything we can find online
B. Nothing
C. The least amount possible for us to do what we need to do
D. As much as possible
C. The least amount possible for us to do what we need to do
Explanation:
When collecting personal data we need to collect just enough to do what we need to and no more, a majority of countries in the world has laws with verbiage to this effect.
In our data roles and responsibilities, the business owner is responsible for which of these?
A. Be trained in the policies, procedures and standards
B. Perform the backups and restores
C. Assign the sensitivity labels and backup frequency of the data
D. Make the policies, procedures and standards that govern our data security
D. Make the policies, procedures and standards that govern our data security
Explanation:
Mission/Business Owner: Senior executives make the policies that govern our data security.
If we are wanting to implement a governance standard and control framework focused on IT service management, which of these should we implement?
A. COBIT
B. ITIL
C. COSO
D. FRAP
B. ITIL
Explanation:
ITIL (Information Technology Infrastructure Library) focuses on ITSM (IT Service Management).
If an attacker is using Distributed Denial Of Service (DDOS) attacks, which part of the CIA triad is the attacker targeting?
A. Authentication
B. Integrity
C. Confidentiality
D. Availability
D. Availability
Explanation:
Availability threats:
Malicious attacks Distributed Denial Of Service (DDOS), Physical, System compromise, Staff). To mitigate this we use redundancy on Hardware Power (Multiple Power Supplies/UPS’/Generators), Disks (Redundant Array of Independent Disks (RAID)), Traffic paths (Network Design), HVAC, Staff, HA (high availability) and much more.
If we are using the Graham Denning model, which of these is NOT something a subject can execute on an object?
A. Transfer access
B. Read subject
C. Create subject
D. Delete access
B. Read subject
Explanation:
Graham-Denning Model – uses Objects, Subjects, and Rules. It does not use read subjects, it has 8 rules that a specific subject can execute on an object are: Transfer Access. Grant Access. Delete Access. Read Object. Create Object. Destroy Object. Create Subject. Destroy Subject.
After a disaster, which team would be working on returning us to our primary facility, or getting a new site up?
A. Rescue team
B. Recovery team
C. Planning team
D. Salvage team
D. Salvage team
Explanation: Salvage team (failback): Responsible for returning our full infrastructure, staff and operations to our primary site or a new facility if the old site was destroyed. We get the least critical systems up first, we want to ensure the new sites is ready and stable before moving the critical systems back.
What would an IT Security professional’s role be when we talk about patching systems?
A. Everything
B. Apply them
C. Nothing
D. Review them
D. Review them
Explanation:
The security team would review the patches and approve them before the server team applies them.
When an attacker has obtained our sensitive data, and chooses to disclose it on a website, which leg of the CIA triad would be MOST affected?
A. Availability
B. Integrity
C. Authentication
D. Confidentiality
D. Confidentiality
Explanation:
Disclosure is the opposite of confidentiality someone not authorized getting access to your information.
In our access control implementations, we are wanting to ensure the accountability of our users. Which of these could be something we could use for that?
A. A password
B. Their username
C. Role based access control
D. Non-repudiation
D. Non-repudiation
Explanation:
Accountability (often referred to as Auditing): Trace an Action to a Subjects Identity. Proves who performed given action, it provides non-repudiation. Group or shared accounts are never OK, they have zero accountability. Uses audit trails and logs, to associate a subject with its actions.
Which of these would NOT be an acceptable form of dealing with remanence?
A. Degaussing
B. Disk sredding
C. Overwriting
D. Deleting files
D. Deleting files
Explanation:
Deleting a file just removes it from the table; everything is still recoverable.
In a relational database, what is the parent table’s primary key seen as in the child table?
A. Foreign key
B. Primary key
C. Reference key
D. Secondary key
A. Foreign key
Explanation:
Foreign key: They are in relational databases the matching primary key of a parent database table. It is always the primary key in the local DB. Seen from the child table the child key is the primary key and the foreign key is the primary key of the parent table.
What would happen if we are using a Bus topology in our LAN design, and a cable breaks?
A. Nothing the traffic just moves the other way
B. Traffic stops at the break
C. Nothing all nodes are connected to the switch by themselves
D. The traffic is redirected
B. Traffic stops at the break
Explanation:
Bus: All nodes are connected in a line, each node inspects traffic and passes it along. Not very stable, a single break in the cable will break the signal to all nodes past that point, including communication between nodes way past the break. Faulty NICs (Network Interface Card) can also break the chain.
When we implement VLANs, what would that do?
A. Prevent users from accessing the internet
B. Segments a switch into multiple separate logical networks
C. Divides a switch into equally large portions for each VLAN
D. Shows a network administrator the traffic on his network
B. Segments a switch into multiple separate logical networks
Explanation:
VLAN (Virtual LAN) is a broadcast domain that is partitioned and isolated at layer 2. Specific ports on a switch is assigned to a certain VLAN. It allows networks and devices that must be kept separate to share the same physical devices without interacting, for simplicity, security, traffic management, and/or cost reduction.
We want to protect against rainbow tables by implementing salting. What are rainbow tables made up of?
A. Pre-arranged lists of full words and numbers
B. Pre-made list of matching biometrics and passwords
C. Pre-made list of matching passwords and hashes using salts
D. Pre-made list of matching passwords and hashes
D. Pre-made list of matching passwords and hashes |
Explanation:
Rainbow tables attacks: Pre-made list of plaintext and matching ciphertext. Often Passwords and matching Hashes a table can have 1,000,000’s of pairs.
We are getting 50 old spinning disk hard drives. What would we use on the damaged ones to ensure there is NO data remanence, but needed the drive to stay intact?
A. Format
B. Degauss
C. Overwrite
D. Shred
B. Degauss
Explanation
Degaussing should ensure no data remanence, we can’t overwrite or format a damaged drive, and shredding would not leave the drive intact.
We are having problems with the electricity in the area, where we have one of our data centers. What is happening when a brownout occurs?
A. We have a short loss of power
B. We have a long high voltage period
C. We have a long loss of power
D. We have a long low voltage period
D. We have a long low voltage period
Explanation:
Power Fluctuation Terms: Brownout - Long low voltage.
Prime number factorization is an example of what?
A. One way functions
B. Shared key encryption
C. Symmetric encryption
D. Two way functions
A. One way functions
Explanation:
Prime Number Factorization: Factoring large Prime numbers using a one-way factorization - It is easy to multiply 2 numbers, but hard to discern the 2 numbers multiplied from the result.
In object-oriented databases, the objects can have different attributes. Which of them would define the behavior of an object?
A. Classes
B. Schemas
C. Methods
D. Attributes
C. Methods
Explanation:
Methods: Defines the behavior of an object and are what was formally called procedures or functions. Objects contain both executable code and data.
Which of these could be a countermeasure we can use to detect a software keylogger?
A. They are not detectable
B. We could see unauthorized access to certain files
C. Physical inspection of the system
D. Look at which programs are running on the system
D. Look at which programs are running on the system
Explanation:
keylogging (Keystroke logging): A keylogger is added to the users computer and it records every keystroke the user enters. Software, a program installed on the computer. The computer is often compromised by a trojan, where the payload is the keylogger or a backdoor. The keylogger calls home or uploads the keystrokes to a server at regular intervals.
Which of these is not really a methodology, but describes the phases of the software development lifecycle?
A. SDLC
B. Agile
C. RAD
D. Waterfall
A. SDLC
Explanation:
SDLC (Software Development Life Cycle): The SDLC is not really a methodology, but a description of the phases in the life cycle of software development. These phases are (in general), investigation, analysis, design, build, test, implement, maintenance and support (and disposal).
We have asked a vendor to use a source code escrow What could be a reason we would do that?
A. So we can get the source code if we have software errors
B. So we can get the source code if they fail to maintain and update the code
C. So we can view the source code when we want to
D. So we can get the source code if we want to break the contract we have with them, because we have found a cheaper alternative
B. So we can get the source code if they fail to maintain and update the code
Explanation:
Source code escrow: The deposit of the source code of software with a third party escrow agent. Escrow is typically requested by a party licensing software (the licensee), to ensure maintenance of the software instead of abandonment or orphaning. The software source code is released to the licensee if the licensor files for bankruptcy or otherwise fails to maintain and update the software as promised in the software license agreement.
If we are doing a vulnerability scan, it would normally show us all these, EXCEPT which?
A. Malware
B. The OSs used by the systems
C. Systems on the network
D. Open ports
A. Malware
Explanation:
A vulnerability scanner tool is used to scan a network or system for a list of predefined vulnerabilities such as system misconfiguration, outdated software, or a lack of patching, they will not detect viruses or malware unless it has opened ports that shouldn’t be and even then it would just list the port as open. It is very important to understand the output from a vulnerability scan, they can be 100’s of pages for some systems, and how do the vulnerabilities map to Threats and Risks (Risk = Threat x Vulnerability).
