CISSP Practice Questions - All CISSP Domains 120Q - 2022 #1 (1 of 2 / Anthony Today) Flashcards
You are expected to give a networking lecture to the students from the school where you studied a decade ago. What network technology is best described as a token-passing network that uses a pair of rings with traffic flowing in opposite directions?
A. FDDI
B. SONET
C. Token Rign
D. A ring topology
A. FDDI
Explanation:
Synchronous Optical Network (SONET) is a protocol for sending multiple optical streams over fiber, and a ring topology is a design, not a technology. FDDI, or Fiber Distributed Data Interface, is a token-passing network that uses a pair of rings with traffic flowing in opposite directions. FDDI technology is resilient in the case that a ring is broken because it can use the second, in opposite direction, to continue to function. Although Token Ring uses tokens, it does not leverage dual loops.
Bertrand has a set of sensitive documents that he would like to protect from public disclosure. He would like to use a control that, if the documents appear in a public forum, may be used to trace the leak back to the person who was originally given the document copy. What security control would best fulfill this purpose?
A. Digital signature
B. Document staining
C. Hashing
D. Watermarking
D. Watermarking
Explanation:
Watermarking alters a digital object to embed information about the source, either in a visible or hidden form. Digital signatures may identify the source of a document but they are easily removed. Hashing would not provide any indication of the document source, since anyone could compute a hash value. Document staining is not a security control.
Sasha recently joined the cybersecurity of a bank. She is battling against a malware outbreak within the financial department. She leverages a malware analysis tool to capture samples of the malware from several workstations and notices that the code is changing slightly each time. Her boss is asking her to ensure that the antivirus software is up to date on each workstation and believes it might be the weak spot of these workstations. On the other hand, Sasha suspects that the nature of the virus is defeating the antivirus on the workstations. What type of malware is she referring to?
A. Encrypted Virus
B. Multipartite Virus
C. Stealth Virus
D. Polymorphic Virus
D. Polymorphic Virus
Explanation:
Before answering the question, please note that not all information provided in the question is relevant in order to provide an answer. Similar distractions are to be expected at the exam. Given the description of “changing slightly”, only the polymorphic virus could be the correct answer because such a virus would mutate marginally when progressing to other systems. An encrypted virus would change entirely between two systems because they encrypt with different keys each time. As indicated in its name, a multipartite virus is composed of several pieces working together, but are not changing from infection to infection. Finally, a stealth virus is hiding the modifications made from system to system, thus, there are no apparent changes.
Which of the following storage media would not be affected by a degausser?
A. HDD
B. DVD
C. Tape
D. SSD
D. SSD
Explanation:
Solid State Drives (SSD) have integrated circuits instead of magnetic platters, hence leveraging a degausser would not impact the data stored on such devices. Nevertheless, you may risk damaging the device if using a degausser. Note that applying a degausser on DVD, Hard disk drive (HDD) or tapes would modify the data stored on them, as all three types of storage are dealing with magnetic fields.
Youldo Ltd envisions storing its data into the cloud. Which one of the following individuals is normally responsible for fulfilling the operational data protection responsibilities delegated by senior management, such as validating data integrity, testing backups, and managing security policies?
A. User
B. Data Owner
C. Data Custodian
D. Auditor
C. Data Custodian
Explanation:
The data custodian role is responsible for the operational data protection activities, usually defined by policy and senior management. The data owner does bear ultimate responsibility for these tasks, but the data owner is typically a senior leader who delegates operational responsibility to a data custodian.
Henry, a cybersecurity engineer, working for a neighboring school, is in charge of safeguarding the privacy of student records. Which law most directly applies to her situation?
A. HITECH
B. FERPA
C. HIPAA
D. COPPA
B. FERPA
Explanation:
The Family Educational Rights and Privacy Act (FERPA) protects the privacy of students in any educational institution that accepts any form of federal funding. The Children’s Online Privacy Protection Rule (COPPA) imposes requirements on operators’ services provided to children under the age of 13. The Health Information Technology for Economics and Clinical Health Act (HITECH) focuses on the healthcare sector, like the Health Insurance Portability and Accountability Act (HIPAA).
Alfred, a database administrator is preparing a script to pull valuable information from databases. What principle of relational databases ensures the permanency of transactions that have been executed?
A. Isolation
B. Consistency
C. Atomicity
D. Durability
D. Durability
Explanation:
The principle of Durability requires that once a transaction is committed to the database it must be preserved. The principle of Consistency ensures that all transactions are consistent with the logical rules of the database, like for example setting a private key. The principle of Isolation mandates that transactions operate independently. The principle of Atomicity ensures that in the case any part of a database transaction fails, the entire transaction is cancelled.
From the following options, which type of software program exposes the code to anyone who wants to look at it?
A. Unrestricted Source
B. Fixed Source
C. Closed Source
D. Open Source
D. Open Source
Explanation:
The open-source community includes major software packages such as the Linux operating system. Open-source software exposes the source code to public inspection and modification. Although the closed source is not a term used in the industry, it is more often referred to as proprietary software. Fixed source and unrestricted sources are not terminologies that you would encounter in this context.
In recent years, concerns about data privacy and the protection of personal data made it to the top in the tabloid. Information maintained about an individual that can be used to distinguish or trace their identity is known as what type of information?
A. Social Security Number (SSN)
B. Secure Identity Information (SII)
C. Personally Identifiable Information (PII)
D. Personal Health Information (PHI)
C. Personally Identifiable Information (PII)
Explanation:
NIST Special Publication 800-122 - Guide to Protecting the Confidentiality of Personally Identifiable Information - defines PII as any information that can be used to distinguish or trace an individual’s identity, such as name, Social Security number, date, and place of birth, mother’s maiden name, biometric records, and other information that is linked or linkable to an individual such as medical, educational, financial, and employment information. PHI is health-related information about a specific person, Social Security numbers are issued to individuals in the United States, and SII is a made-up term.
Bernard, a new joiner, tries to understand the IT setup in the company you are working for. He asks you the following question: Which technology listed here is designed to prevent a web server going offline from becoming a single point of failure in a web application architecture?
A. RAID
B. Dual Power Supplies
C. Load Balancing
D. IPS
C. Load Balancing
Explanation:
An Intrusion Prevention System, known as IPS, can help to prevent attacks after having detected them. Redundant Array of Independent Disks (RAID) is a disk failure prevention technology. Load balancing can ensure that a failing server does not take a website offline, but instead redirects the traffic to another server. Dual-power supplies are power prevention measures that provide systems with two sources of power to increase their resiliency in the case of a power failure.
Jean is a cybersecurity expert working with an experienced computer forensics investigator. He has been tasked to retrieve a forensic drive controller, but he can find any forensic drive controller in the storage room. What would be another name for this device?
A. RAID Controller
B. Forensic Device analyzer
C. SCSI Terminator
D. Write Blocker
D. Write Blocker
Explanation:
Forensic disc controllers are also named write blocker because, in essence, they prevent any content modification command to be sent to the device.
You are a security consultant that has been engaged for testing the security measures of an application. From the following options, which technique focuses on testing the design and the logic of the software structure?
A. Logic-box test
B.White box test
C. Black Box Test
D. Gray Box Test
B.White box test
Explanation:
There three types of penetration tests, the black-box test that is conducted as an external attacker without any knowledge of the environment, the gray-box test that is executed with partial knowledge of the client’s environment such as the IP of the servers, or the technology used. Finally, there are the white-box test where a pentester would have access to the code of the application. Such an approach enables a thorough test of the algorithms and can spot logical weaknesses. The term logic-box test is a made-up term for some distractions.
Daniel has been hired to strengthen the CISO team. During the interview process, he was asked the following question: Which one of the following systems assurance processes provides an independent third-party evaluation of a system’s controls that may be trusted by many different organizations?
A. Verification
B. Certification
C. Accreditation
D. Definition
A. Verification
Explanation:
The verification process is similar to the certification process in that it validates security controls. Verification may go a step further by involving a third-party testing service and compiling results that may be trusted by many different organizations. Accreditation is the act of management formally accepting an evaluating system, not evaluating the system itself.
Sally just came out of law school but is interested in IT. After conducting a qualitative risk assessment of her organization, she recommends purchasing cybersecurity breach insurance. What type of risk response behavior is she recommending?
A. Accept
B. Transfer
C. Reduce
D. Reject
B. Transfer
Explanation:
Purchasing insurance is a means of transferring risk. Acceptance would have been the case if Sally would have recommended going forward with the status quo. Risk reduction would take place if she would have advised taking measures that would either lower the likelihood or the impact, or both, of a risk. Rejection is not a valid risk treatment strategy.
As a risk manager for your company, one of your colleagues asks you the following question: Which one of the following is an example of risk transference?
A. Relocating Facilities
B. Erecting Fences
C. Purchasing Insurance
D. Building a Guard Shock
C. Purchasing Insurance
Explanation:
Risk transference involves actions that shift risk from one party to another. Purchasing insurance is an example of risk transference because it moves the risk from the insured to the insurance company.
Antoine, a security auditor, is looking at some logs. Which one of the following is not a privileged administrative activity that should be automatically sent to a log of superuser actions?
A. Restoring a system from backup
B. Purging log entries from the system
C. Logging into a workstation
D. Managing user accounts
C. Logging into a workstation|
Explanation:
From the listed options, logging into a workstation is likely not to be considered as privileged administrative activity. All the other options are administrative activities that should be conducted by experts having privileged administrative accesses.
You are part of a large telecommunication company, operating in central Europe. From the following roles, which one might be the most effective organizational owner of the information security program you have suggested?
A. Chief Information Officer
B. CISSP-Certified Analyst
C. President and CEO
D. Manager of network security
A. Chief Information Officer
Explanation:
From the contextual information, only the size of the organization matters because there is a higher likelihood that these roles would be covered by different people. In smaller organizations, the same person may have several hats. Thus, from the listed option, the CIO would be the most senior individual in the perfect position to advocate for an appropriate security program. Although a CEO may be acquainted with technology and security measures, their domain of expertise often lies within the core business of the company. A manager of network security would certainly have the technical skills but lacks the aura and influence from the CIO. And finally, a CISSP certified analyst might be a person from the security team, who would not have the organizational weight to carry a security program.
There is a growing interest from the attacker in gathering valuable information from us. What common security issue is often overlooked with cordless phones?
A. Their signal is rarely encrypted and thus can be easily monitored
B. They can allow attackers access to wireless networks;/
C. They are rarely patched and are vulnerable to malware
D. They use unlicensed frequencies
A. Their signal is rarely encrypted and thus can be easily monitored
Explanation:
Signals from cordless phones are not encrypted, or at best use weak encryption methods that are breakable in a matter of minutes. This weakness exposes the conversations to eavesdropping, and thus there is a risk to compromise confidentiality.
Tao is the risk manager for NukePower, an electric powerhouse on the east coast of Japan. The data center is located in an area prone to seismic activities. Tao estimated that rebuilding the data center would cost Y10 million. An earthquake might destroy at least half of the data center. Experts determined that NukePower may suffer from an earthquake once every 200 years. What is the annualized loss expectancy for this data center being hit by an earthquake?
A. Y500,000
B. Y50,000
C. Y25,000
D. Y250,000
C. Y25,000
Explanation:
The annualized loss expectancy is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). In this case, the SLE is Y5,000,000, and the ARO is 0.005. Multiplying these numbers together gives you the ALE of Y25,000.
Which method could be leveraged to take advantage of how a system handles multiple requests?
A. State attacks
B. State machine model
C. Aggregation
D. Message Authentication Code (MAC)
A. State attacks
Explanation:
The state attack, better known under race condition attack or TOCTOU, is taking place when a system has to deal with multiple requests at the same time. Such an attack takes place on shared data, between the moment the data is checked and the moment it is used. The other terms listed here are not relevant.
Henry is performing a security risk assessment for his firm and is evaluating the risks associated with a flood inundating the firm’s building. The Local Environmental Agency, the LEA, determined that the building is located in a 100-year flood plain. Henry estimates that a flood would cause $5M of damage to the $40M building. What is the Annualized Loss Expectancy?
A. $50,000
B. $500,000,000
C. $5,000,000
D. $500,000
A. $50,000
Explanation:
ALE = SLE x ARO. To calculate the Annualized Loss Expectancy (ALE, $), you need to multiply the Single Loss Expectancy (SLE, $) with the Annualized Rate of Occurrence (ARO, ratio). In this scenario, the SLE corresponds to “Henry estimates that a flood would cause $5M of damage”. Hence, translating it to 1 event will cost $5M. Therefore, SLE=$5M. Thus, the ARO corresponds to “the building is located in a 100-year flood plain”. Hence, translate it to 1 flood in 100 years. Accordingly, ARO=1/100=0.01. Let’s calculate the ALE = SLE x ARO = $5M x 0.01 = $50,000 = $50k.
Alfred is planning to deploy a new firewall on the perimeter of his organization’s network. What category of control does the firewall fit into?
A. Detective B. Preventive C. Administrative D. Corrective E. Attentive
B. Preventive
Explanation:
A properly configured firewall aims to decline communications that are not authorized. Therefore, the implementation of firewalls is a preventive control as it acts before the incident could take place. The other answers are not matching with a firewall.
At TrustBee, every manager has clearly defined responsibilities. What should be an important function filled by senior managers on a business continuity planning team?
A. Designing failure controls
B. Arbitrating disputes about criticality
C. Evaluating the legal environment
D. Training staff
B. Arbitrating disputes about criticality
Explanation:
The primary function of senior managers in business continuity planning roles is to set priorities, get the required resources and arbitrate disputes about criticality.
The organization that Matthieu works for has a traditional onsite Active Directory environment that uses a manual provisioning process for each addition to their 430-employee company. As the company adopts new technologies, they are increasingly using software as a service applications to replace their internally developed software stack. After having been in contact with several service providers, Matthieu selected the most appropriate offer. Now, he has been tasked with designing an identity management implementation that will allow his company to use cloud services while supporting their existing systems. Which technology should Matthieu use if needs to share identity information with business partners?
A. IDaaS
B.Single Sign On
C. Multifactor authentication
D. Federation
D. Federation
Explanation:
From the listed options, Federation is the only technology that links identity information between multiple organizations. Federating with a business partner can allow identification and authorization to occur between them, making integration much easier. Single sign-on might help to reduce the number of times a user has to enter its credentials. Multifactor might help to strengthen the authentication process. To conclude, an identity as a service (IDaaS) provider does not necessarily provide a federation.
