Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Test King CISSP > Extra 1357-1448 > Flashcards

Extra 1357-1448 Flashcards

1
Q

QUESTION NO: 1357 Which type of network topology passes all traffic through all active nodes? A. Broadband B. Star C. Baseband D. Token Ring

A

Answer: D Explanation: Token ring passes all traffic through nodes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

QUESTION NO: 1358 The act of validating a user with a unique and specific identifier is called what? A. Validation B. Registration C. Authentication D. Authorization E. Identification

A

Answer: C Explanation: Authentication is the act of validating a user with a unique and specific identifier.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

QUESTION NO: 1359 Why is fiber the most secure means of transmission? A. High speed multiplexing B. Interception of traffic is more difficult because it is optically based C. Higher data rates make it more secure D. Multiplexing prevents traffic analysis E. Built-in fault tolerance

A

Answer: B Explanation: Fiber is more secure because it is hard to tap into and gives off no EMI such as copper cabling.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

QUESTION NO: 1360 The IAB defines which of the following as a violation of ethics? A. Performing a DoS B. Downloading an active control C. Performing a penetration test D. Creating a virus E. Disrupting Internet communications

A

Answer: E Explanation: The IAB considers the Internet a privilege, not a right, and as such considers it unethical to purposely disrupt communications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

QUESTION NO: 1361 A chain of custody shows who ______ _________ and _________.(Choose three) A. Who controlled the evidence B. Who transcribed the evidence C. Who validated the evidence D. Who presented the evidence E. Secured the evidence F. Obtained the evidence

A

Answer: A,E,F Explanation: The chain of evidence shows who obtained the evidence, who secured the evidence, and who controlled the evidence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

QUESTION NO: 1362 Good forensics requires the use of a bit level copy?(True/False) A. True B. False

A

Answer: A Explanation: Good forensics requires the use of a bit level copy. A bit level copy duplicates all information on the suspect’s disk. This includes slack space and free space.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

QUESTION NO: 1363 Which agency shares the task of investigating computer crime along with the FBI? A. Secret Service B. CIA C. Department of justice D. Police force E. NSA

A

Answer: A Explanation: Along with the FBI, the Secret Service has been given the authority to investigate computer crime.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

QUESTION NO: 1364 This type of password recovery is considered more difficult and must work through all possible combinations of numbers and characters. A. Passive B. Active C. Dictionary D. Brute force E. Hybrid

A

Answer: D Explanation: Brute force cracking is considered more difficult and must work through all possible combinations of numbers and characters.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

QUESTION NO: 1365 _______ are added to Linux passwords to increase their randomness. A. Salts B. Pepper C. Grains D. MD5 hashes E. Asymmetric algorithms

A

Answer: A Explanation: Salts are added to Linux passwords to increase their randomness. They are used to help insure that no two users have the same, hashed password.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

QUESTION NO: 1366 The Linux root user password is typically kept in where?(Choose two) A. etc/shadow B. cmd/passwd C. etc/passwd D. windows/system32 E. var/sys F. var/password

A

Answer: A,C Explanation: The Linux root user password is typically kept in /etc/passwd or etc/shadow.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

QUESTION NO: 1367 The goal of cryptanalysis is to ____________. A. Determine the number of encryption permutations required B. Reduce the system overhead for a crypto-system C. Choose the correct algorithm for a specified purpose D. Forge coded signals that will be accepted as authentic E. Develop secure crypto-systems

A

Answer: D Explanation: The goal of cryptanalysis is to forge coded signals that will be accepted as authentic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

QUESTION NO: 1368 If an employee is suspected of computer crime and evidence need to be collected, which of the following departments must be involved with the procedure? A. Public relations B. Law enforcement C. Computer security D. Auditing E. HR

A

Answer: E Explanation: Human Resources always needs to be involved if an employee is suspected of wrongdoing. They know what rules apply to protect and prosecute employees.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

QUESTION NO: 1369 What is it called when a system has apparent flaws that were deliberately available for penetration and exploitation? A. A jail B. Investigation C. Enticement D. Data manipulation E. Trapping

A

Answer: C Explanation: Administrators that leave systems with apparent flaws are performing an act of enticement. This is sometimes called a honeypot.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

QUESTION NO: 1370 Why are computer generated documents not considered reliable? A. Difficult to detect electron tampering B. Stored in volatile media C. Unable to capture and reproduce D. Too delicate E. Because of US law, Section 7 paragraph 154

A

Answer: A Explanation: Because it is difficult to detect electron tampering and can be easily modified.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

QUESTION NO: 1371 What is the name of the software that prevents users from seeing all items or directories on a computer and is most commonly found in the UNIX/Linux environment? A. Shell Kits B. Root Kits C. Ethereal D. Shadow data E. Netbus

A

Answer: D

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

QUESTION NO: 1372 What is a commercial application of steganography that is used to identify pictures or verify their authenticity? A. A MAC B. A digital checksum C. A MD5 hash D. A digital signature E. A watermark

A

Answer: E Explanation: A watermark is a commercial application of steganography that is used to identify pictures or verify its authenticity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

QUESTION NO: 1373 What are the basic questions that must be asked at the beginning of any investigation?(Choose all that apply) A. Who B. Cost C. What D. When E. Where F. How G. Time frame H. Budget

A

Answer: A,C,D,E,F Explanation: At the beginning of any investigation, an investigator must ask who, what, when, where, and how. Answering the questions will lead to the successful conclusion of the case.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

QUESTION NO: 1374 Risk can be eliminated.(True/False) A. True B. False

A

Answer: B Explanation: Risk can never be eliminated. It may be reduced or transferred to a third party through insurance, but will always remain in some form.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

QUESTION NO: 1375 Employees are a greater risk to employers than outsiders. T/F(True/False) A. True B. False

A

Answer: A Explanation: Employees are a greater risk to employers than outsiders, because they possess two of the three items required to commit a crime: means and opportunity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

QUESTION NO: 1376 When an organization takes reasonable measures to ensure that it took precautions to protect its network and resources is called: A. Reasonable Action B. Security Mandate C. Due Care D. Prudent Countermeasures

A

Answer: C Explanation: Due care are the steps taken to show it has taken responsibility for its actions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

QUESTION NO: 1377 What two things below are associated with security policy?(Choose Two) A. Support of upper management B. Support of department managers C. Are tactical in nature D. Are strategic in nature E. Must be developed after procedures F. Must be developed after guidelines

A

Answer: A,D Explanation: Policies are written as a broad overview and require the support of upper management. After the development and approval of policies, guidelines and procedures may be written.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

QUESTION NO: 1378 Total risk is equal to:(Choose All That Apply) A. Threat B. Vulnerability C. Frequency D. Asset value E. Asset loss

A

Answer: A,B,D Explanation: Total risk = asset value * vulnerability * threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

QUESTION NO: 1379 Government data classifications include which of the following:(Choose four) A. Open B. Unclassified C. Confidential D. Private E. Secret F. Top Secret

A

Answer: B,C,E,F Explanation: One of the most common systems used to classify information is the one developed within the US Department of Defense. These include: unclassified, sensitive, confidential, secret, and top secret.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

QUESTION NO: 1380 Job rotation is important because: A. It insures your employees are cross-trained. B. It increases job satisfaction. C. It reduces the opportunity for fraud

A

Answer: C Explanation: Job rotation is tightly tied to the principle of least privilege. It is an effective security control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

QUESTION NO: 1381 Your co-worker is studying for the CISSP exam and has come to you with a question. What is ARP poisoning? A. Flooding of a switched network B. A denial of service that uses the DNS death ping C. Turning of IP to MAC resolution D. Inserting a bogus IP and MAC address in the ARP table E. Modifying a DNS record

A

Answer: D Explanation: ARP poisoning is a masquerading attack where the attacker inserts a bogus IP and MAC address in a victims ARP table or into the table of a switch. This has the effect of redirecting traffic to the attacker and not to the intended computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

QUESTION NO: 1382 What is the best description for CHAP Challenge Handshake Authentication Protocol? A. Passwords are sent in clear text B. Passwords are not sent in clear text C. Passwords are not used, a digital signature is sent D. It is substandard to PAP E. It was used with PS2’s and has been discontinued

A

Answer: B Explanation: Passwords are not sent in clear text. The server performing the authentication sends a challenge value and the user types in the password. The password is used to encrypt the challenge value then is sent back to the authentication server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

QUESTION NO: 1383 CSMA/CD computers cannot communicate without a token.(True/False) A. True B. False

A

Answer: B Explanation: CSMA/CD computers do not use a token. It is the media access method used in Ethernet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

QUESTION NO: 1384 __________ sends out a message to all other computers indicating it is going to send out data. A. CSMA/CD B. CSMA/CA C. CSMA/HB D. PPP E. SLIP

A

Answer: B Explanation: CSMA/CA sends out a message to all other computers indicating it is going to send out data. CSMA/CA or token ring networking uses this approach to reduce the amount of data collisions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

QUESTION NO: 1385 Which of the following best describes ISDN BRI(Choose two) A. 2 B channels B. 4 B channels C. 23 B channels D. 1 D channel E. 2 D channels

A

Answer: A,D Explanation: ISDN BRI has 2 B and 1 D channels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

QUESTION NO: 1386 The top speed of ISDN BRI is 256 KBS.(True/False) A. True B. False

A

Answer: B Explanation: The top speed of ISDN BRI is 128 KBS. Its two primary channels are each capable of carrying 64 KBS so the combined top speed is 128 KBS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

QUESTION NO: 1387 Which of the following should NOT be implemented to protect PBX’s?(Choose all that apply) A. Change default passwords and configurations B. Make sure that maintenance modems are on 24/7 C. Review telephone bill regularly D. Block remote calling after business hours E. Post PBX configuration and specs on the company website

A

Answer: B,E Explanation: Many vendors have maintenance modems that vendors can use to troubleshoot systems and provide updates. They should normally be turned off. Also information about the system should not be posted on the website and should be closely guarded.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

QUESTION NO: 1388 Which of the following best describes the difference between a circuit based and application based firewall? A. Application based is more flexible and handles more protocols B. Circuit based provides more security C. Application based builds a state table D. Circuit based looks at IP addresses and ports E. Circuit based firewalls are only found in Cisco routers

A

Answer: D Explanation: Circuit based look only at IP address and ports, whereas application based dig much deeper into the packet. This makes it more secure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

QUESTION NO: 1389 _________ is the fraudulent use of telephone services. A. Rolling B. Warzing C. Wardriving D. Wardialing E. Phreaking

A

Answer: E Explanation: Phreaking is the fraudulent use of telephone services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

QUESTION NO: 1390 What is another name for a VPN? A. Firewall B. Tunnel C. Packet switching D. Pipeline E. Circuit switching

A

Answer: B Explanation: A VPN creates a secure tunnel through an insecure network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

QUESTION NO: 1391 Which of the following is a connection-orientated protocol? A. IP B. UDP C. TCP D. ICMP E. SNMP F. TFTP

A

Answer: C Explanation: TCP is a connection-orientated protocol.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

QUESTION NO: 1392 Which of the following is not considered firewall technology? A. Screened subnet B. Screened host C. Duel gateway host D. Dual homed host

A

Answer: C Explanation: Duel gateway host is not considered firewall technology.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

QUESTION NO: 1393 Which of the following can be used to defeat a call-back security system? A. Call waiting B. Passive wiretapping C. Active wiretapping D. Brute force password attacks E. Call forwarding

A

Answer: E Explanation: Call forwarding can be used to bypass the call back feature and is considered a security risk.

38
Q

QUESTION NO: 1394 Which type of network topology passes all traffic through all active nodes? A. Broadband B. Star C. Baseband D. Token Ring

A

Answer: D Explanation: Token ring passes all traffic through nodes.

39
Q

QUESTION NO: 1395 The act of validating a user with a unique and specific identifier is called what? A. Validation B. Registration C. Authentication D. Authorization E. Identification

A

Answer: C Explanation: Authentication is the act of validating a user with a unique and specific identifier.

40
Q

QUESTION NO: 1396 Why is fiber the most secure means of transmission? A. High speed multiplexing B. Interception of traffic is more difficult because it is optically based C. Higher data rates make it more secure D. Multiplexing prevents traffic analysis E. Built-in fault tolerance

A

Answer: B Explanation: Fiber is more secure because it is hard to tap into and gives off no EMI such as copper cabling.

41
Q

QUESTION NO: 1397 The IAB defines which of the following as a violation of ethics? A. Performing a DoS B. Downloading an active control C. Performing a penetration test D. Creating a virus E. Disrupting Internet communications

A

Answer: E Explanation: The IAAB considers the Internet a privilege, not a right, and as such considers it unethical to purposely disrupt communications.

42
Q

QUESTION NO: 1398 A chain of custody shows who ______ _________ and _________.(Choose three) A. Who controlled the evidence B. Who transcribed the evidence C. Who validated the evidence D. Who presented the evidence E. Secured the evidence F. Obtained the evidence

A

Answer: A,E,F Explanation: The chain of evidence shows who obtained the evidence, who secured the evidence, and who controlled the evidence.

43
Q

QUESTION NO: 1399 Good forensics requires the use of a bit level copy?(True/False) A. True B. False

A

Answer: A Explanation: Good forensics requires the use of a bit level copy. A bit level copy duplicates all information on the suspect’s disk. This includes slack space and free space.

44
Q

QUESTION NO: 1400 Which agency shares the task of investigating computer crime along with the FBI? A. Secret Service B. CIA C. Department of justice D. Police force E. NSA

A

Answer: A Explanation: Along with the FBI, the Secret Service has been given the authority to investigate computer crime.

45
Q

QUESTION NO: 1401 This type of password recovery is considered more difficult and must work through all possible combinations of numbers and characters. A. Passive B. Active C. Dictionary D. Brute force E. Hybrid

A

Answer: D Explanation: Brute force cracking is considered more difficult and must work through all possible combinations of numbers and characters.

46
Q

QUESTION NO: 1402 _______ are added to Linux passwords to increase their randomness. A. Salts B. Pepper C. Grains D. MD5 hashes E. Asymmetric algorithms

A

Answer: A Explanation: Salts are added to Linux passwords to increase their randomness. They are used to help insure that no two users have the same, hashed password.

47
Q

QUESTION NO: 1403 The Linux root user password is typically kept in where?(Choose two) A. etc/shadow B. cmd/passwd C. etc/passwd D. windows/system32 E. var/sys F. var/password

A

Answer: A,C Explanation: The Linux root user password is typically kept in /etc/passwd or etc/shadow.

48
Q

QUESTION NO: 1404 The goal of cryptanalysis is to ____________. A. Determine the number of encryption permutations required B. Reduce the system overhead for a crypto-system C. Choose the correct algorithm for a specified purpose D. Forge coded signals that will be accepted as authentic E. Develop secure crypto-systems

A

Answer: D Explanation: The goal of cryptanalysis is to forge coded signals that will be accepted as authentic.

49
Q

QUESTION NO: 1405 If an employee is suspected of computer crime and evidence need to be collected, which of the following departments must be involved with the procedure? A. Public relations B. Law enforcement C. Computer security D. Auditing E. HR

A

Answer: E Explanation: Human Resources always needs to be involved if an employee is suspected of wrongdoing. They know what rules apply to protect and prosecute employees.

50
Q

QUESTION NO: 1406 What is it called when a system has apparent flaws that were deliberately available for penetration and exploitation? A. A jail B. Investigation C. Enticement D. Data manipulation E. Trapping

A

Answer: C Explanation: Administrators that leave systems with apparent flaws are performing an act of enticement. This is sometimes called a honeypot.

51
Q

QUESTION NO: 1407 Why are computer generated documents not considered reliable? A. Difficult to detect electron tampering B. Stored in volatile media C. Unable to capture and reproduce D. Too delicate E. Because of US law, Section 7 paragraph 154

A

Answer: A Explanation: Because it is difficult to detect electron tampering and can be easily modified.

52
Q

QUESTION NO: 1408 What is the name of the software that prevents users from seeing all items or directories on a computer and is most commonly found in the UNIX/Linux environment? A. Shell Kits B. Root Kits C. Ethereal D. Shadow data E. Netbus

A

Answer: D

53
Q

QUESTION NO: 1409 What is a commercial application of steganography that is used to identify pictures or verify their authenticity? A. A MAC B. A digital checksum C. A MD5 hash D. A digital signature E. A watermark

A

Answer: E Explanation: A watermark is a commercial application of steganography that is used to identify pictures or verify its authenticity.

54
Q

QUESTION NO: 1410 What are the basic questions that must be asked at the beginning of any investigation?(Choose all that apply) A. Who B. Cost C. What D. When E. Where F. How G. Time frame H. Budget

A

Answer: A,C,D,E,F Explanation: At the beginning of any investigation, an investigator must ask who, what, when, where, and how. Answering the questions will lead to the successful conclusion of the case.

55
Q

QUESTION NO: 1411 Risk can be eliminated.(True/False) A. True B. False

A

Answer: B Explanation: Risk can never be eliminated. It may be reduced or transferred to a third party through insurance, but will always remain in some form.

56
Q

QUESTION NO: 1412 Employees are a greater risk to employers than outsiders. T/F(True/False) A. True B. False

A

Answer: A Explanation: Employees are a greater risk to employers than outsiders, because they possess two of the three items required to commit a crime: means and opportunity.

57
Q

QUESTION NO: 1413 What does the term “red boxing” mean? A. Denial of Service B. Telephone voltage manipulation C. Sounds of coins dropping D. Tone manipulation E. A salami attack

A

Answer: C Explanation: Red boxing was used by phone phreakers to record the sound off coins dropping in pay phones and play it back to gain free phone access.

58
Q

QUESTION NO: 1414 Which of the following is the proper lifecycle of evidence? A. A Collection, storage, present in court, destroy B. Collection, transportation, storage, return to owner C. Collection, present in court, transportation, return to owner D. Collection, analysis, storage, present in court, return to owner E. Collection, storage, transportation, present in court, return to owner

A

Answer: D Explanation: The life cycle of evidence includes: collection, analysis, storage, present in court, and return to owner

59
Q

QUESTION NO: 1415 A copy of a computer disk would be what type of evidence? A. Secondary B. Best C. Hearsay D. Direct E. Indirect

A

Answer: C Explanation: A copy of a computer disk is considered hearsay, because unless it has been copied in a forensically approved manner, it is not credible evidence.

60
Q

QUESTION NO: 1416 A copyright protects _________. A. The trade secrets of a company B. A persons private papers C. An invention D. An expression or an idea E. Distinguishing or unique characters, colors, or words

A

Answer: D Explanation: A copyright protects the expression of a resource, not the resource directly.

61
Q

QUESTION NO: 1417 ________ is a ________ attack that eavesdrops on communication. (Choose two) A. Passive B. Active C. Brute force D. Wiretapping E. Password cracking

A

Answer: A,D Explanation: Wiretapping is a passive attack that eavesdrops on communication. It is only legal with prior consent or a warrant.

62
Q

QUESTION NO: 1418 What types of laws are considered standards of performance or conduct expected by government agencies from companies, industries, and certain officials.(Chose all that apply) A. Civil B. Criminal C. Administrative D. Regulatory E. Tort

A

Answer: C,D Explanation: Administrative or regulatory laws are considered standards of performance or conduct expected by government agencies from companies, industries, and certain officials.

63
Q

QUESTION NO: 1419 Sandra’s employer is considering placing login banners on all company computers to indicate to the users about the permitted use of company computers. What is this called? A. Employee privacy law B. Employee policies C. Employee regulations D. User policies E. Acceptable use policy

A

Answer: E Explanation: Acceptable use policies provide the company with legal protection. Logon banners should be used to inform users what will happen if they do not follow company rules.

64
Q

QUESTION NO: 1420 ________ deemed proprietary to a company and can be information that provides a competitive edge. A. Trade secrets are B. Copyrights are C. Restricted information is D. Information marked strictly private is

A

Answer: A Explanation: Trade secrets are deemed proprietary to a company and can be information that provides a competitive edge. This information is protected as long as the owner takes the necessary security actions.

65
Q

QUESTION NO: 1421 Sandra is studying for her CISSP exam. Sandra has come to you for help and wants to know what the last step in the change control process is? A. Validated and approved B. Test and implement C. Review and approve D. Report change to management E. Inform user of change

A

Answer: D Explanation: Reporting the change to management is the last step in the process.

66
Q

QUESTION NO: 1422 Who is ultimately responsible for the security of an organization? A. Management B. Senior management C. The chief security officer D. Department heads E. Employees

A

Answer: B Explanation: Senior management is ultimately responsible for the security of an organization. Policy flows from the top down.

67
Q

QUESTION NO: 1423 Which of the following falls under the categories of configuration management?(Choose three) A. Operating system configuration B. Software configuration C. Hardware configuration D. Logical configuration E. Physical configuration

A

Answer: A,B,C Explanation: Configuration management controls the changes that take place in hardware, software, and operating systems.

68
Q

QUESTION NO: 1424 Macro viruses infect what type of files. A. Microsoft office files B. Mail servers C. E-mail messages D. Web browsers E. Linux Kernel files

A

Answer: A Explanation: Macro viruses infect Microsoft office files. There are many macro viruses because the macro language is easy to use and because Microsoft Office is prolific.

69
Q

QUESTION NO: 1425 What is another name for rows and columns within relational databases?(Choose two) A. Relations B. Keys C. Tuples D. Views E. Attributes

A

Answer: C,E Explanation: Within a relational database, the rows of a table are called tuples and the columns are called attributes.

70
Q

QUESTION NO: 1426 Which of the following can reproduce itself without the help of system applications or resources? A. Trojan B. Logic bomb C. Virus D. Worm E. Backdoor

A

Answer: D Explanation: Worms can reproduce themselves without the help of system applications or resources.

71
Q

QUESTION NO: 1427 What is the final stage of the system development life cycle? A. Certification B. Validation C. Evaluation D. Implementation E. Maintenance F. Installation

A

Answer: E Explanation: Maintenance is the final stage of the system development life cycle.

72
Q

QUESTION NO: 1428 A polymorphic virus is _____________. A. A virus that makes copies of itself and then makes changes to those copies B. A virus that can make itself stealth C. A virus that is written in a macro language D. A virus that is written in visual basic E. A virus that infects the boot sector of a hard drive

A

Answer: A Explanation: A polymorphic virus is a virus that makes copies of itself, then makes changes to those copies. It does this in hopes of avoiding detection of anti-virus software.

73
Q

QUESTION NO: 1429 Which one of the following is identified by a business impact analysis?(Choose three) A. Determining regulatory requirements B. Analyzing the threats associated with each functional area C. Determining the risk associated with each threat D. Identifying the major functional areas of information E. Determining the team members that will be associated with disaster planning

A

Answer: B,C,D Explanation: The following identifies a business impact analysis: analyzing the threats associated with each functional area, determining the risk associated with each threat, and identifying the major functional areas of information.

74
Q

QUESTION NO: 1430 _______ are the step-by-step instructions used to satisfy control requirements. A. Policy B. Procedure C. Guideline D. Standard E. Outline

A

Answer: B Explanation: Procedures are the step-by-step instructions used to satisfy control requirements.

75
Q

QUESTION NO: 1431 Which of the following are controls that can be used to secure faxing of sensitive data?(Choose all that apply) A. Disable automatic printing B. Print “sensitive document banner” on each page C. Fax encryptor D. Send to email boxes instead of printing E. Restrict the use of fax machines that use a ribbon or duplication cartridge

A

Answer: A,C,D,E Explanation: All of the items listed can help secure faxes except printing a sensitive document banner, which actually encourages people to look at the document.

76
Q

QUESTION NO: 1432 Which of the following are considered administrative controls?(Choose all that apply) A. Rotation of duties B. Separation of duties C. Implementation of WEP keys D. Enforcing mandatory vacations

A

Answer: A,B,D Explanation: Rotation of duties, separation of duties, and mandatory vacations are all administrative controls, enforcing WEP is a technical control

77
Q

QUESTION NO: 1433 Why should organizations enforce separation of duties? A. It ensures compliance with federal union rules B. It helps verify that all employees know their job tasks C. It provides for a better work environment D. It encourages collusion E. It is considered valuable in deterring fraud

A

Answer: E Explanation: Separation of duties is considered valuable in deterring fraud since fraud can occur if an opportunity exists for collaboration between various job related capabilities. The most commonly used examples are the separate transactions needed to initiate a payment and to authorize a payment. No single individual should be capable of executing both transactions.

78
Q

QUESTION NO: 1434 What is the most secure way to dispose of data held on a CD? A. Reformatting B. Sanitizing C. Physical destruction D. Degaussing

A

Answer: C Explanation: Since CD’s cannot be sanitized in a way to remove all data, they should be physically destroyed. There are many products that con do this. Some actually shred the CD!

79
Q

QUESTION NO: 1435 What is the most accepted way to dispose data held on a floppy disk? A. Reformatting B. Sanitizing C. Physical destruction D. Degaussing

A

Answer: D Explanation: Degaussing is the most accepted way of disposing data held on a floppy disk.

80
Q

QUESTION NO: 1436 Which of the following is NOT an attack against operations? A. Morris Worm B. SYN Denial of Service C. Buffer Overflow D. Brute force E. Known plain text attack

A

Answer: E Explanation: A known plain text attack is an attack against the organization’s cryptosystem, not a direct attack against operations.

81
Q

QUESTION NO: 1437 Which one of the following tools can be used to launch a Distributed Denial of service attack against a network? A. Satan B. Saint C. Trinoo D. Nmap E. Netcat

A

Answer: C Explanation: Trinoo and the Tribal Flood Network (TFN) are the two most commonly used distributed denial of service attacks. The other four tools mentioned are reconnaissance techniques used to map networks and scan for known vulnerabilities.

82
Q

QUESTION NO: 1438 Which one of the following network attacks takes advantages of weaknesses in the fragment reassembly functionality of the TCP/IP protocol stack? A. Teardrop B. Smurf C. Ping of Death D. SYN flood E. SNMP Attack

A

Answer: A Explanation: The teardrop attack uses overlapping packet fragments to confuse a target system and cause the system to reboot or crash.

83
Q

QUESTION NO: 1439 What are the elements of the CIA triad?(Choose three) A. Confidentiality B. Accountability C. Accessibility D. Integrity E. Interest F. Control G. Availability

A

Answer: A,D,G Explanation: The essential security principles of confidentiality, integrity, and availability are referred to as the CIA Triad.

84
Q

QUESTION NO: 1440 ____________ is the first step of access control. A. Identification B. Authorization C. Validation D. Interrogation E. Accountability logging

A

Answer: A Explanation: The first step in the access control process is identifying who the subject is.

85
Q

QUESTION NO: 1441 What is a Type 2 authentication factor? A. Something you know B. Something you are C. Something you have

A

Answer: C Explanation: A Type 2 authentication factor is something you have, such as a smart card, ATM card, token device, memory card, etc.

86
Q

QUESTION NO: 1442 _______ requires that two entities work together to complete a task? A. Rotation of duties B. Separation of duties C. Dual controls D. Enforced mandatory vacations E. Workplace rules

A

Answer: C Explanation: Dual controls require that two entities work together to complete a task. This is used to reduce the possibility of fraud.

87
Q

QUESTION NO: 1443 PGP provides which of the following?(Choose three) A. Confidentiality B. Accountability C. Accessibility D. Integrity E. Interest F. Non-repudiation G. Authenticity

A

Answer: A,D,G Explanation: PGP provides confidentiality, integrity, and authenticity.

88
Q

QUESTION NO: 1444 Computer security is generally considered the responsibility of everyone in the organization.(True/False) A. True B. False

A

Answer: A Explanation: Everyone is responsible for security.

89
Q

QUESTION NO: 1445 Which aspect of security was the Bell-LaPadula access control model designed to protect? A. Authenticity B. Accountability C. Accessibility D. Integrity E. Interest F. Non-repudiation G. Confidentiality

A

Answer: G Explanation: The Bell-LaPadula model is focused on maintaining confidentiality.

90
Q

QUESTION NO: 1446 Which access control method uses security policies and security awareness training to stop or deter an unauthorized activity from occurring? A. Administrative B. Preventative C. Detective D. Authoritative E. Corrective .

A

Answer: B Explanation: Preventative access control is deployed to stop an unauthorized activity from occurring

91
Q

QUESTION NO: 1447 The Secure Hash Algorithm (SHA) is specified in? A. Digital Encryption Standard B. Digital Signature Standard C. Digital Encryption Standard D. Advanced Encryption Standard E. NSA 1403

A

Answer: B Explanation: SHA is specified in DSS, not DES. DSS: http://www.itl.nist.gov/fipspubs/fip186.htm DES: http://www.itl.nist.gov/fipspubs/fip46-2.htm

92
Q

QUESTION NO: 1448 Which of the following is an example of a symmetric key algorithm?(Choose all that apply) A. Rijndael B. RSA C. Diffie-Hellman D. Knapsack E. IDEA

A

Answer: A,E Explanation: All the others except Rijndael and IDEA are examples of asymmetric key algorithms.

Test King CISSP (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions