Unique Top-selling CISSP Exams - New 2021 ISC Pratice Exam
ISC Certification Dumps CISSP Exam for Full Questions - Exam Study Guide
NEW QUESTION 379
Who is accountable for the information within an Information System (IS)?
- A. Security manager
- B. System owner
- C. Data owner
- D. Data processor
Answer: B
Explanation:
Section: Security Operations
NEW QUESTION 380
In the days before CIDR (Classless Internet Domain Routing), networks were commonly organized by classes. Which of the following would have been true of a Class A network?
- A. The first three bits of the IP address would be set to one.
- B. The first bit of the IP address would be set to zero.
- C. The first bit of the IP address would be set to one and the second bit set to zero.
- D. The first two bits of the IP address would be set to one, and the third bit set to zero.
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Class A contains all addresses in which the most significant bit is zero. The address range of Class A is
0.0.0.0 - 127.255.255.255.
Incorrect Answers:
B: Class A contains only one single fixed bit, not two.
C: Class A contains only one single fixed bit, not three.
D: Class A contains only one single fixed bit, not three.
References:
https://en.wikipedia.org/wiki/Classful_network
NEW QUESTION 381
During an IS audit, one of your auditors has observed that some of the critical servers in your organization can be accessed ONLY by using a shared/common user name and password. What should be the auditor's PRIMARY concern be with this approach?
- A. Difficulty in auditing shared account
- B. Password sharing
- C. Shared account management
- D. Accountability
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Identification and authentication are the keystones of most access control systems. Identification is the act of a user professing an identity to a system, usually in the form of a log-on ID to the system. Identification establishes user accountability for the actions on the system. Authentication is verification that the user's claimed identity is valid and is usually implemented through a user password at log-on time.
Audit trails list the actions performed by the user account used to perform the actions. However, if all the users are using the same user account, you have no way of knowing which person performed which action. Therefore, you have no "accountability".
Incorrect Answers:
A: Password sharing is not the primary concern in this case. The only password shared is the password for the shared account.
C: Shared account management is not a concern. The fact that the account is shared is the concern.
D: Difficulty in auditing shared account is not the primary concern. Auditing a single account is not a problem. The problem is that you do not know which person is using the account at any given time.
References:
Krutz, Ronald L. and Russell Dean Vines, The CISSP and CAP Prep Guide: Mastering CISSP and CAP, Wiley Publishing, Indianapolis, 2007, p. 57
NEW QUESTION 382
Which of the following MUST be considered when developing business rules for a data loss prevention (DLP) solution?
- A. Data availability
- B. Data ownership
- C. Data sensitivity
- D. Data integrity
Answer: C
NEW QUESTION 383
Which is NOT considered a physical intrusion detection method?
- A. Wave pattern motion detector
- B. Photoelectric sensor
- C. Audio motion detector
- D. Line supervision
Answer: D
Explanation:
Line supervision is the monitoring of the alarm signaling transmission medium to detect tampering. Audio detectors monitor a room for any abnormal sound wave generation. Photoelectric sensors receive a beam of light from a light-emitting device. Wave pattern motion detectors generate a wave pattern and send an alarm if the pattern is disturbed.
NEW QUESTION 384
Of the multiple methods of handling risks which we must undertake to carry out business operations, which one involves using controls to reduce the risk?
- A. Avoidance
- B. Transference
- C. Acceptance
- D. Mitigation
Answer: D
Explanation:
Risk mitigation is the practice of the elimination of, or the significant decrease in the level of risk presented. Mitigating risk means you work around the risk with measures to reduce the risk. A good example could be a locked down web server or firewall. You benefit from the service they provide but mitigate risks involved by technical measures.
Another example of risk mitigation can be seen in everyday life and are readily apparent in the information technology world. For example, to lessen the risk of exposing personal and financial information that is highly sensitive and confidential organizations put countermeasures in place, such as firewalls, intrusion detection/prevention systems, and other mechanisms, to deter malicious outsiders from accessing this highly sensitive information.
Understand that conducting business in a computing world means assumption of risk. You have to make a management decision on whether to avoid, mitigate, transfer or simply accept it as a risk of doing business.
The following answers are incorrect:
Avoid: Risk with avoidance is when we eliminate the risk by avoiding it altogether. No surprise there but this answer is distinct from the others because you simply don't undertake the risky process. It is incorrect here because you're not reducing the risk with controls as with mitigation.
Acceptance: This means that the risk is identified and understand and evaluated to be acceptable in order to conduct business operations. It is incorrect because you are accepting that the risk is present and conducting business anyhow but don't mitigate risk with controls like in the question here.
Transference: When we transfer risk, we pay someone else to undertake the risk on our behalf so that we may conduct operations and benefit from the risk but don't undertake the risky operation ourselves. This is not the same as mitigation so it is incorrect.
The following reference(s) was used to create this question:
Gregg, Michael; Haines, Billy (2012-02-16). CASP: CompTIA Advanced Security
Practitioner Study Guide Authorized Courseware: Exam CAS-001 (p. 217-218). Wiley.
Kindle Edition.
and
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third
Edition ((ISC)2 Press) (Kindle Locations 10183-10195). Auerbach Publications. Kindle
Edition.
NEW QUESTION 385
Which of the following is the biggest concern with firewall security?
- A. Complex configuration rules leading to misconfiguration
- B. Buffer overflows
- C. Distributed denial of service (DDOS) attacks
- D. Internal hackers
Answer: A
Explanation:
Firewalls tend to give a false sense of security. They can be very hard to bypass but they need to be properly configured. The complexity of configuration rules can introduce a vulnerability when the person responsible for its configuration does not fully understand all possible options and switches. Denial of service attacks mainly concerns availability. Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, Chapter 3: Telecommunications and Network Security (page 412).
NEW QUESTION 386
A polymorphic virus is _____________.
- A. A virus that makes copies of itself and then makes changes to those copies
- B. A virus that is written in visual basic
- C. A virus that is written in a macro language
- D. A virus that infects the boot sector of a hard drive
- E. A virus that can make itself stealth
Answer: A
Explanation:
A polymorphic virus is a virus that makes copies of itself, then makes changes to those copies. It does this in hopes of avoiding detection of anti-virus software.
NEW QUESTION 387
Which of the following processes has the PRIMARY purpose of identifying outdated software versions, missing patches, and lapsed system updates?
- A. Life cycle management
- B. Vulnerability management
- C. Penetration testing
- D. Software Development Life Cycle (SDLC)
Answer: B
Explanation:
Reference:
https://resources.infosecinstitute.com/category/certifications-training/cissp/domains/security-operations/vulnerab
NEW QUESTION 388
Which of the following services should be logged for security purpose?
- A. All of the choices.
- B. bootp
- C. sunrpc
- D. tftp
Answer: A
Explanation:
Request for the following services should be logged: systat, bootp, tftp, sunrpc, snmp, snmp-trap, nfs.
NEW QUESTION 389
Which of the following is a method of multiplexing data where a communication channel is divided into an arbitrary number of variable bit-rate digital channels or data streams. This method allocates bandwidth dynamically to physical channels having information to transmit?
- A. Frequency division multiplexing
- B. Time-division multiplexing
- C. Statistical multiplexing
- D. Asynchronous time-division multiplexing
Answer: C
Explanation:
Statistical multiplexing is a type of communication link sharing, very similar to
dynamic bandwidth allocation (DBA). In statistical multiplexing, a communication channel is
divided into an arbitrary number of variable bit-rate digital channels or data streams. The link
sharing is adapted to the instantaneous traffic demands of the data streams that are transferred
over each channel. This is an alternative to creating a fixed sharing of a link, such as in general
time division multiplexing (TDM) and frequency division multiplexing (FDM). When performed
correctly, statistical multiplexing can provide a link utilization improvement, called the statistical
multiplexing gain.
Generally, the methods for multiplexing data include the following :
Time-division multiplexing (TDM): information from each data channel is allocated bandwidth
based on pre-assigned time slots, regardless of whether there is data to transmit. Time-division multiplexing is used primarily for digital signals, but may be applied in analog multiplexing in which two or more signals or bit streams are transferred appearing simultaneously as sub-channels in one communication channel, but are physically taking turns on the channel. The time domain is divided into several recurrent time slots of fixed length, one for each sub-channel. A sample byte or data block of sub-channel 1 is transmitted during time slot 1, sub-channel 2 during time slot 2, etc. One TDM frame consists of one time slot per sub-channel plus a synchronization channel and sometimes error correction channel before the synchronization. After the last sub-channel, error correction, and synchronization, the cycle starts all over again with a new frame, starting with the second sample, byte or data block from sub-channel 1, etc.
Asynchronous time-division multiplexing (ATDM): information from data channels is allocated bandwidth as needed, via dynamically assigned time slots. ATM provides functionality that is similar to both circuit switching and packet switching networks: ATM uses asynchronous time-division multiplexing, and encodes data into small, fixed-sized packets (ISO-OSI frames) called cells. This differs from approaches such as the Internet Protocol or Ethernet that use variable sized packets and frames. ATM uses a connection-oriented model in which a virtual circuit must be established between two endpoints before the actual data exchange begins. These virtual circuits may be "permanent", i.e. dedicated connections that are usually preconfigured by the service provider, or "switched", i.e. set up on a per-call basis using signalling and disconnected when the call is terminated.
Frequency division multiplexing (FDM): information from each data channel is allocated bandwidth based on the signal frequency of the traffic. In telecommunications, frequency-division multiplexing (FDM) is a technique by which the total bandwidth available in a communication medium is divided into a series of non-overlapping frequency sub-bands, each of which is used to carry a separate signal. This allows a single transmission medium such as the radio spectrum, a cable or optical fiber to be shared by many signals.
Reference used for this question: http://en.wikipedia.org/wiki/Statistical_multiplexing and http://en.wikipedia.org/wiki/Frequency_division_multiplexing and Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, Chapter 3: Technical Infrastructure and Operational Practices (page 114).
NEW QUESTION 390
Which choice below represents an application or system demonstrating
a need for a high level of confidentiality protection and controls?
- A. The application contains proprietary business information and other financial information, which if disclosed to unauthorized sources, could cause an unfair advantage for vendors, contractors, or individuals and could result in financial loss or adverse legal action to user organizations.
- B. Unavailability of the system could result in inability to meet payroll obligations and could cause work stoppage and failure of user organizations to meet critical mission requirements. The system requires 24-hour access.
- C. Destruction of the information would require significant expenditures of time and effort to replace. Although corrupted information would present an inconvenience to the staff, most information, and all vital information, is backed up by either paper documentation or on disk.
- D. The mission of this system is to produce local weather forecast information that is made available to the news media forecasters and the general public at all times. None of the information requires protection against disclosure.
Answer: A
Explanation:
Although elements of all of the systems described could require specific controls for confidentiality, given the descriptions above, system b fits the definition most closely of a system requiring a very high level of confidentiality. Answer a is an example of a system requiring high availability. Answer c is an example of a system that requires medium integrity controls. Answer d is a system that requires only a low level of confidentiality. Asystem may need protection for one or more of the following reasons: Confidentiality. The system contains information that requires protection from unauthorized disclosure. Integrity. The system contains information that must be protected from unauthorized, unanticipated, or unintentional modification. Availability. The system contains information or provides services which must be available on a timely basis to meet mission requirements or to avoid substantial losses. Source: NIST Special Publication 800-18, Guide for Developing Security Plans for Information Technology Systems
NEW QUESTION 391
Determining outage costs caused by a disaster can BEST be measured by the
- A. revenue lost during the outage.
- B. cost of redundant systems and backups.
- C. cost to recover from an outage.
- D. overall long-term impact of the outage.
Answer: D
Explanation:
Section: Software Development Security
NEW QUESTION 392
Which of the following is a LAN transmission protocol?
- A. Ethernet
- B. Ring Topology
- C. Unicast
- D. Polling
Answer: C
Explanation:
Reference: "LAN Transmission Methods. LAN data is transmitted from the sender to one or more receiving stations using either a unicast, multicast, or broadcast transmission." pg 528 Hansche: Official (ISC)2 Guide to the CISSP Exam
NEW QUESTION 393
What is the maximum allowable key size of the Rijndael encryption algorithm?
- A. 128 bits
- B. 192 bits
- C. 256 bits
- D. 512 bits
Answer: C
Explanation:
The Rijndael algorithm, chosen as the Advanced Encryption Standard (AES) to replace DES, can be categorized as an iterated block cipher with a variable block length and key length that can be independently chosen as 128, 192 or 256 bits.
Below you have a summary of the differences between AES and Rijndael.
AES is the advanced encryption standard defined by FIPS 197. It is implemented differently than Rijndael:
FIPS-197 specifies that the block size must always be 128 bits in AES, and that the key size may be either 128, 192, or 256 bits. Therefore AES-128, AES-192, and AES-256 are actually:
Key Size (bits) Number of rounds
Block Size (bits)
AES-128
1 28 10 Rounds
1 28
AES-192
1 92 12 Rounds
1 28
AES-256
2 56 14 Rounds
1 28
Some book will say "up to 9 rounds will be done with a 128 bits keys". Really it is 10 rounds because you must include round zero which is the first round.
By contrast, the Rijndael specification per se is specified with block and key sizes that may be any multiple of 32 bits, both with a minimum of 128 and a maximum of 256 bits.
Reference(s) used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, John Wiley & Sons, 2001, Chapter 4: Cryptography (page
153).
and
FIPS 197
and
https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
NEW QUESTION 394
What are the four basic elements of Fire?
- A. Heat, Wood, Oxygen, and Chain Reaction
- B. Heat, Fuel, CO2, and Chain Reaction
- C. Heat, Fuel, Oxygen, and Chain Reaction
- D. Flame, Fuel, Oxygen, and Chain Reaction
Answer: C
Explanation:
Four elements must be presentin order for fire to exist. These elements are HEAT,
FUEL, OXYGENand CHAIN REACTION.
While not everything is known about the combustion process, it is generally accepted that fire is a
chemical reaction. This reaction is dependent upon a material rapidly oxidizing, or uniting with
oxygen so rapidly that it produces heat and flame.
Until the advent of newer fire extinguishing agents, fire was thought of as a triangle with the three
sides represented by heat, fuel, and oxygen. If any one of the three sides were to be taken away,
the fire would cease to exist.
Studies of modern fire extinguishing agents have revealed a fourth element - a self propagating
chain reaction in the combustion process. As a result, the basic elements of fire are represented
by the fire tetrahedron - HEAT, FUEL, OXYGEN and CHAIN REACTION.
Fire Tetrahedron
The theory of fire extinguishment is based on removing any one or more of the four elements in the fire tetrahedron to suppress the fire.
REMOVING THE HEAT In order to remove the heat, something must be applied to the fire to absorb the heat or act as a heat exchanger. Water is not the only agent used to accomplish this, but it is the most common.
REMOVING THE FUEL Under many circumstances, it is not practical to attempt to remove the fuel from the fire. When dealing with flammable liquid fires, valves can be shut off and storage vessels pumped to safe areas to help eliminate the supply of fuel to the fire. Flammable gas fires are completely extinguished by shutting off the fuel supply.
REMOVE THE OXYGEN Oxygen as it exists in our atmosphere (21%) is sufficient to support combustion in most fire situations. Removal of the air or oxygen can be accomplished by separating it from the fuel source or by displacing it with an inert gas. Examples of separation would be foam on a flammable liquid fire, a wet blanket on a trash fire, or a tight fitting lid on a skillet fire. Agents such as CO2, nitrogen, and steam are used to displace the oxygen.
INTERRUPT THE CHAIN REACTION
Modern extinguishing agents, such as dry chemical and halons, have proven to be effective on
various fires even though these agents do not remove heat, fuel, or oxygen. Dry chemical and
halogenated agents are thought to suspend or bond with "free radicals" that are created in the
combustion process and thus prevent them from continuing the chain reaction.
It must be noted that Halon is now banned in most country or cities. The agreement banning Halon
Production is called The Montreal Protocol.
Click on the following link to see a nice video on fire fighting and extinguishing agents, it cover key
information you need to know for the exam.
Resume of the class of Fires:
Class of Fires
All of the other answers are incorrect:
References: Fire and Fire Extinguishment and http://code7700.com/fire.html
NEW QUESTION 395
The communications products and services, which ensure that the various components of a network (such as devices, protocols, and access methods) work together refers to:
- A. Network Architecture.
- B. Multiprotocol Architecture.
- C. Netware Architecture.
- D. WAN Architecture.
Answer: A
Explanation:
A Network Architecture refers to the communications products and services, which ensure that the various components of a network (such as devices, protocols, and access methods) work together.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 101.
NEW QUESTION 396
Which process on a firewall makes permit/deny forwarding decisions based solely on address and service port information?
- A. Circuit Proxy
- B. Transparency Proxy
- C. Application Proxy
- D. Stateful Packet Inspection Proxy
Answer: A
Explanation:
Circuit-level proxy creates a circuit between the client computer and the server. It does not understand or care about the higher-level issues that an application-level proxy deals with. It knows the source and destinations addresses and makes access decisions based on this information...IT looks at the data within the packet header versus the data within the payload of the packet. It does not know if the contents within the packet are actually safe or not. - Shon Harris All-in-one CISSP Certification Guide pg 419-420
NEW QUESTION 397
Which of the following elements MUST a compliant EU-US Safe Harbor Privacy Policy
contain?
- A. An explanation of the regulatory frameworks and compliance standards the information collecting organization adheres to.
- B. An explanation of who can be contacted at the organization collecting the information if corrections are required by the data subject.
- C. An explanation of how long the data subject's collected information will be retained for and how it will be eventually disposed.
- D. An explanation of all the technologies employed by the collecting organization in gathering information on the data subject.
Answer: B
NEW QUESTION 398
An organization has outsourced its financial transaction processing to a Cloud Service Provider (CSP) who will provide them with Software as a Service (SaaS). If there was a data breach who is responsible for monetary losses?
- A. The Data Protection Authority (DPA)
- B. The Cloud Service Provider (CSP)
- C. The data owner
- D. The application developers
Answer: B
Explanation:
Section: Software Development Security
NEW QUESTION 399
A chemical plan wants to upgrade the Industrial Control System (ICS) to transmit data using Ethernet instead of RS422. The project manager wants to simplify administration and maintenance by utilizing the office network infrastructure and staff to implement this upgrade.
Which of the following is the GREATEST impact on security for the network?
- A. The network administrators have no knowledge of ICS
- B. The ICS does not support the office password policy
- C. The ICS is now accessible from the office network
- D. RS422 is more reliable than Ethernet
Answer: C
Explanation:
Section: Communication and Network Security
NEW QUESTION 400
The act of requiring two of the three factors to be used in the authentication process refers to?
- A. Double Authentication
- B. Two-Factor Authentication
- C. One-Factor Authentication
- D. Bi-Factor Authentication
Answer: B
Explanation:
Two-Factor Authentication is a security process that confirms user identities using two distinctive factors-something you know, such as a Personal
Identification Number (PIN), and something you have, such as a smart card or token.
The overall strength of Two-Factor Authentication lies in the combination of both factors, something you know and something you have.
NEW QUESTION 401
......
Best way to practice test for ISC CISSP: https://www.realvce.com/CISSP_free-dumps.html
CISSP Dump Ready - Exam Questions and Answers: https://drive.google.com/open?id=1CNL_t_jc9L4r_ORje1aOi5tUVYHtzSeA