CISSP - Exam Practice/Study Questions with accurate answers, graded A+. Latest update.

CISSP - Exam Practice/Study Questions with accurate answers, graded A+. Latest update. What is the most effective defense against cross-site scripting attacks? a) Limiting account privileges b)User Authentication c) Input validation d)encryption c) Input validation prevents cross-site scripting attacks by limiting user input to a predefined range. This prevents the attacker from including the HTML ˂SCRIPT˃ tag in the input. What phase of the Electronic Discovery Reference Model puts evidence in a format that may be shared with others? a) production b) processing c) revice d) presentation a) Production places the information in a format that may be shared with others. What form of security planning is designed to focus on timeframes of approximately one year and may include scheduling of tasks, assignment of responsibilities, hiring plans, maintenance plans, and even acquisition plans? a)strategic b) operational c) tactical d)administrative c.) tactical planning is designed to focus on timeframes of approximately one year and may include scheduling of tasks, assignment of responsibilities, hiring plans, maintenance plans, and even acquisition plans. Which is not a part of an electronic access control lock? A. An electromagnet B. A credential reader C. A door sensor D. A biometric scanner d -An electronic access control (EAC) lock comprises three elements: an electromagnet to keep the door closed, a credential reader to authenticate subjects and to disable the electromagnet, and a door-closed sensor to reenable the electromagnet. Which one of the following items is a characteristic of hot sites but not a characteristic of warm sites? a.Communications circuits B. Workstations C. Servers D. Current data d- current data Which one of the following Data Encryption Standard (DES) operating modes can be used for large messages with the assurance that an error early in the encryption/decryption process won't spoil results throughout the communication? A. Cipher Block Chaining (CBC) B. Electronic Code Book (ECB) C. Cipher Feedback (CFB) D. Output feedback (OFB) d -Output feedback (OFB) mode prevents early errors from interfering with future encryption/decryption. Cipher Block Chaining and Cipher Feedback modes will carry errors throughout the entire encryption/decryption process. Electronic Code Book (ECB) operation is not suitable for large amounts of data. Which one of the following items is not a critical piece of information in the chain of evidence? A. General description of the evidence B. Name of the person collecting the evidence C. Relationship of the evidence to the crime D. Time and date the evidence was collected c -The chain of evidence does not require that the evidence collector know or document the relationship of the evidence to the crime. Which firewall type looks exclusively at the message header to determine whether to transmit or drop data? A. Static packet filtering B. Application-level gateway C. Stateful inspection D. Dynamic packet filtering a -A static packet-filtering firewall filters traffic by examining data from a message header. What type of information is used to form the basis of an expert system's decision-making process? A. A series of weighted layered computations B. Combined input from a number of human experts, weighted according to past performance C. A series of "if/then" rules codified in a knowledge base D. A biological decision-making process that simulates the reasoning process used by the human mind c -Expert systems use a knowledge base consisting of a series of "if/then" statements to form decisions based on the previous experience of human experts. What type of cryptographic attack rendered Double DES (2DES) no more effective than standard DES encryption? A. Birthday attack B. Chosen ciphertext attack C. Meet-in-the-middle attack D. Man-in-the-middle attack c -The meet-in-the-middle attack demonstrated that it took relatively the same amount of computation power to defeat 2DES as it does to defeat standard DES. This led to the adoption of Triple DES (3DES) as a standard for government communication. Which of the following is most directly associated with providing or supporting perfect forward secrecy? A. PBKDF2 B. ECDHE C. HMAC D. OCSP B- Elliptic Curve Diffie-Hellman Ephemeral, or Elliptic Curve Ephemeral Diffie-Hellman (ECDHE), implements perfect forward secrecy through the use of elliptic curve cryptography (ECC). PBKDF2 is an example of a key-stretching technology not directly supporting perfect forward secrecy. HMAC is a hashing function. OCSP is used to check for certificate revocation. What is the best way to understand the meaning of the term 100-year flood plain? A. A flood that occurs once every 100 years B. A flood larger than any recorded in the past 100 years C. A very serious but very unlikely flood event D. A very serious flood that has a probability of 1 in 100 (1%) of occurring in any single calendar year D-Flood levels rated in years (100-year, 500-year, 1,000-year, and so forth) basically reflect estimates of the probability of their occurrence. An area rated as a 100-year flood plain has a 1 in 100 chance of occurring in any given calendar year (1%), a 500-year flood has a 1 in 500 chance of occurring in any given calendar year, and so forth. Options A and B misrepresent the meaning of the 100-year interval mentioned, while option C fails to address its probabilistic intent. What is the formula used to compute the ALE? A. ALE = AV EF ARO B. ALE = ARO * EF C. ALE = AV * ARO D. ALE = EF * ARO a -The Annualized Loss Expectancy (ALE) is computed as the product of the asset value (AV) times the exposure factor (EF) times the annualized rate of occurrence (ARO). This is the longer form of the formula ALE = SLE * ARO. The other formulas displayed here do not accurately reflect this calculation. Matthew and Richard want to communicate with each other using a public key cryptosystem. What is the total number of keys they must have to successfully communicate? A. 1 B. 2 C. 3 D. 4 To use public key cryptography, Matthew and Richard must each have their own pair of public and private cryptographic keys. atunnel mode VPN is used to connect which types of systems? A. Hosts and servers B. Clients and terminals C. Hosts and networks D. Servers and domain controllers c-Tunnel mode VPNs are used to connect networks to networks or networks to hosts. Transport mode is used to connect hosts to hosts. Host, server, client, terminal, and domain controller are all synonyms. ___________________ is any hardware, software, or administrative policy or procedure that defines and enforces access and restriction rights on an organizational level. A. Logical control B. Technical control C. Access control D. Administrative control c- access control Which of the following cryptographic attacks can be used when you have access to an encrypted message but no other information? A. Known plain-text attack B. Frequency analysis attack C. Chosen cipher-text attack D. Meet-in-the-middle attack b-Frequency analysis may be used on encrypted messages. The other techniques listed require additional information, such as the plaintext or the ability to choose the ciphertext. Which of the following approaches uses mathematical algorithms to analyze data, developing models that may be used to predict future activity? A. Expert systems B. Data mining C. Data warehousing D. Information discovery b- Data mining uses mathematical approaches to analyze data, searching for patterns that predict future activity. Vulnerabilities and risks are evaluated based on their threats against which of the following? A. One or more of the CIA Triad principles B. Data usefulness C. Due care D. Extent of liability a- CIA The Twofish algorithm uses an encryption technique not found in other algorithms that XORs the plain text with a separate subkey before the first round of encryption. What is this called? A. Preencrypting B. Prewhitening C. Precleaning D. Prepending b-Prewhitening XORs the plain text with a separate subkey before the first round of encryption. When you are configuring a wireless extension to an intranet, once you've configured WPA-2 with 802.1x authentication, what additional security step could you implement in order to offer additional reliable security? A. Require a VPN. B. Disable SSID broadcast. C. Issue static IP addresses. D. Use MAC filtering. a -VPNRequiring a VPN to access the private wired network in addition to WPA-2 and 802.1x is the only additional reliable security option. Which one of the following is not a major asset category normally covered by the BCP (business continuity plan)? A. People B. Documentation C. Infrastructure D. Buildings/facilities b- The BCP normally covers three major asset categories: people, infrastructure, and buildings/facilities. What is a security risk of an embedded system that is not commonly found in a standard PC? A. Software flaws B. Access to the internet C. Control of a mechanism in the physical world D. Power loss C- Because an embedded system is in control of a mechanism in the physical world, a security breach could cause harm to people and property. This typically is not true of a standard PC. Power loss, internet access, and software flaws are security risks of both embedded systems and standard PCs. what is the most common cause of failure for water based fire suppression systems? a. water shortage b. people c. ioniziation detectors d. placement of detectors in drop ceilings b- people -humans turn off water after fire and forget to turn back on What type of motion detector senses charges in the electrical or magnetic field surrounding a monitored object? a. wave b. photoelectric c. heat d. capacitance Capacitance is the ratio of the amount of electric charge stored on a conductor to a difference in electric potential What is the ideal humidity range for computer room? 40-60% What network devices operate within the Physical layer? A. Bridges and switches B. Firewalls C. Hubs and repeaters D. Routers c- hubs and repeaters What method is not integral to assuring effective and reliable security staffing? A. Screening B. Bonding C. Training D. Conditioning D- conditioning.Screening, bonding, and training are all vital procedures for ensuring effective and reliable security staffing because they verify the integrity and validate the suitability of said staffers Which of the following is not an expected result of requiring users to regularly change their workstation assignment or physical location? A. Deters collusion between employees because ever-changing constellations of co-workers are less likely to bond sufficiently to perform unauthorized or illegal activities together B. Encourages users to store personal information on systems C. Encourages users to keep all work materials on network servers where they can be easily protected, overseen, and audited D. Gives users little or no opportunity to customize their systems or to install unapproved software because subsequent users will discover and report such changes B-Options A, C, and D are examples of valid reasons why changes to workstation assignments or physical location can improve or maintain security. Regularly changing workstation assignment or location discourages users from storing personal information on systems. Among the following attack patterns, which is not considered a form of amplified or denial of service attack? A. Flooding B. Spoofing C. Ping of death D. Smurf b- Spoofing is the replacement of valid source and destination IP and port addresses with false ones. It is often used in DoS attacks but is not considered a DoS attack itself. Flooding, smurf, and ping of death are all DoS attacks. What type of evidence refers to written documents that are brought into court to prove a fact? A. Best evidence B. Payroll evidence C. Documentary evidence D. Testimonial evidence c- written documents brought into court to prove the facts of a case are referred to as documentary evidence. If you are the victim of a bluejacking attack, what was compromised? A. Your firewall B. Your switch C. Your cell phone D. Your web cookies C- _______________ is the process by which a subject provides a username, logon ID, personal identification number, and so on. A. Accountability B. Authentication C. Confidentiality D. Identification D-Identification is the process by which a subject professes an identity and accountability is initiated. When NAC is used to manage an enterprise network, what is most likely to happen to a notebook system once reconnected to the intranet after it has been out of the office for six weeks while in use by an executive on an international business trip? A. Reimaged B. Updated at next refresh cycle C. Quarantine D. User must reset their password c- NAC often operates in a pre-admission philosophy in which a system must meet all current security requirements (such as patch application and antivirus updates) before it is allowed to communicate with the network. This often means systems that are not in compliance are quarantined or otherwise involved in a captive portal strategy in order to force compliance before network access is restored. Beth is planning to run a network port scan against her organization's web server. What ports should she expect will be open to the world? A. 80 and 443 B. 22 and 80 C. 80 and 1433 D. 22, 80, and 443 a- Web servers should expose ports 80 and/or 443 to the world to support HTTP and/or HTTPS connections. Port 22, used by SSH, and port 1433, used by SQL Server databases, should not normally be publicly exposed. What part of the Common Criteria specifies the claims of security from the vendor that are built into a target of evaluation? A. Protection profiles B. Evaluation assurance level C. Certificate authority D. Security target D- Security targets (STs) specify the claims of security from the vendor that are built into a TOE. What form of password attack utilizes a preassembled lexicon of terms and their permutations? A. Rainbow tables B. Dictionary word list C. Brute force D. Educated guess b-Dictionary word lists are precompiled lists of common passwords and their permutations and serve as the foundation for a dictionary attack on accounts. Which one of the following is not a requirement that Internet service providers must satisfy in order to gain protection under the "transitory activities" clause of the Digital Millennium Copyright Act? A. The service provider and the originator of the message must be located in different states. B. The transmission, routing, provision of connections, or copying must be carried out by an automated technical process without selection of material by the service provider. C. Any intermediate copies must not ordinarily be accessible to anyone other than anticipated recipients and must not be retained for longer than reasonably necessary. D. The transmission must be originated by a person other than the provider. a-The Digital Millennium Copyright Act does not include any geographical location requirements for protection under the "transitory activities" exemption. The other options are three of the five mandatory requirements. The other two requirements are that the service provider must not determine the recipients of the material and the material must be transmitted with no modification to its content. What is the primary objective of a spoof attack? A. To send large amounts of data to a victim B. To cause a buffer overflow C. To hide the identity of an attacker through misdirection D. To steal user accounts and passwords c-Spoofing grants the attacker the ability to hide their identity through misdirection. It is therefore involved in most attacks. Which of the following is true regarding vulnerability scanners? A. They actively scan for intrusion attempts. B. They serve as a form of enticement. C. They locate known security holes. D. They automatically reconfigure a system to a more secure state. Vulnerability scanners are used to test a system for known security vulnerabilities and weaknesses. They are not active detection tools for intrusion, they offer no form of enticement, and they do not configure system security. In addition to testing a system for security weaknesses, they produce evaluation reports, which include recommendations. What is a security risk of an embedded system that is not commonly found in a standard PC? A. Software flaws B. Access to the internet C. Control of a mechanism in the physical world D. Power loss c-Because an embedded system is in control of a mechanism in the physical world, a security breach could cause harm to people and property. This typically is not true of a standard PC. Power loss, internet access, and software flaws are security risks of both embedded systems and standard PCs. Which of the following does not usually represent a timeframe of increased risk and vulnerability to an organization, such as information disclosure, data loss, and unplanned downtime? A. Layoffs B. Awareness training C. Acquisitions D. Mergers b-Awareness training typically reduces risk and vulnerability. Which of the following is not a denial-of-service attack? A. Exploiting a flaw in a program to consume 100 percent of the CPU B. Sending malformed packets to a system, causing it to freeze C. Performing a brute-force attack against a known user account when account lockout is not present D. Sending thousands of emails to a single address c What is the second phase of the IDEAL software development model? A. Developing B. Diagnosing C. Determining D. Designing B-The second phase of the IDEAL software development model is the Diagnosing stage. In what scenario would you perform bulk transfers of backup data to a secure off-site location? A. Incremental backup B. Differential backup C. Full backup D. Electronic vaulting D-Electronic vaulting describes the transfer of backup data to a remote backup site in a bulk-transfer fashion. What law amended the Health Insurance Portability and Accountability Act to include data breach notification requirements? A. FERPA B. HITECH C. PCI DSS D. CALEA B-The Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH) amended HIPAA to include new regulations related to data breach notification and the compliance requirements of covered entity business associates. If you require the most advanced and complete method of off-site backup, what option do you choose? A. Manual backups B. Automated backups C. Remote mirroring D. Remote journaling C-Remote mirroring is the most advanced, complete, and expensive off-site backup solution. With this solution, a live database server is kept off-site at some secure remote location. Which of the following is a true statement regarding the EU-U.S. Privacy Shield? A. It is the updated and renamed version of the International Safe Harbor Privacy Principles. B. It extends HIPPA protections for U.S. citizens to countries in Europe. C. It was declared invalid by the European Court of Justice. D. It provides a means by which U.S. companies can process EU citizens' personal data. D-The true statement from this list is that the EU-U.S. Privacy Shield provides a means by which U.S. companies can process EU citizens' personal data. The International Safe Harbor Privacy Principles were declared invalid by the European Court of Justice; thus, the EU-US Privacy Shield is a replacement for Safe Harbor but not a renamed and revised version of Safe Harbor. EU-US Privacy Shield does not extend HIPPA protections for U.S. citizens to countries in Europe. Which of the following is a fake network designed to tempt intruders with unpatched and unprotected security vulnerabilities and false data? A. IDS B. Honeynet C. Padded cell D. Pseudo flaw B-Honeypots are individual computers, and honeynets are entire networks created to serve as a trap for intruders. They look like legitimate networks and tempt intruders with unpatched and unprotected security vulnerabilities as well as attractive and tantalizing but false data. An intrusion detection system (IDS) will detect attacks. In some cases, an IDS can divert an attacker to a padded cell, which is a simulated environment with fake data intended to keep the attacker's interest. A pseudo flaw (used by many honeypots and honeynets) is a false vulnerability intentionally implanted in a system to tempt attackers. Christopher would like to send Renee a message using a digital signature. What key should he use to create the digital signature? A. Christopher's public key B. Christopher's private key C. Renee's public key D. Renee's private key B-The sender of a message uses their own private key to create a digital signature. Christopher recently received word that his application for a trademark was approved by the US Patent and Trademark Office. What symbol should he use next to the name to indicate its protected status? A. © B. ® C. ™ D. † The ® symbol is reserved for trademarks that have received official registration status by the US Patent and Trademark Office. What law protects the privacy rights of students? A. HIPAA B. SOX C. GLBA D. FERPA D-The Family Educational Rights and Privacy Act (FERPA) protects the rights of students and the parents of minor students. What security protocol has become the de facto standard used to provide secure e-commerce services? A. S/MIME B. TLS C. SET D. PGP B-Transport Layer Security (TLS), the revised replacement for SSL, has become the de facto standard used to provide secure e-commerce services. This is in spite of the attempts of several credit card companies to promote alternate options, such as Secure Electronic Transaction (SET). Which of the following is a type of connection that can be described as a logical circuit that always exists and is waiting for the customer to send data? A. ISDN B. PVC C. VPN D. SVC B-A permanent virtual circuit (PVC) can be described as a logical circuit that always exists and is waiting for the customer to send data. What software development model uses a seven-stage approach with a feedback loop that allows progress one step backward? A. Boyce-Codd B. Waterfall C. Spiral D. Agile B-The waterfall model uses a seven-stage approach to software development and includes a feedback loop that allows development to return to the previous phase to correct defects discovered during the subsequent phase. Which of the following wireless technologies supports multifactor authentication options? A. WEP B. TKIP C. CCMP D. WPA2 D Both WPA and WPA2 support the enterprise authentication known as 802.1x/EAP, a standard port-based network access control that ensures clients cannot communicate with a resource until proper authentication has taken place. Effectively, 802.1x is a hand-off system that allows the wireless network to leverage the existing network infrastructure's authentication services. Through the use of 802.1x, other techniques and solutions such as RADIUS, TACACS, certificates, smart cards, token devices, and biometrics can be integrated into wireless networks providing techniques for both mutual and multi-factor authentication. What is the weakest link in a security chain? A. Internet connection B. People C. Documentation D. Hardware B-People are the weakest link in a security chain. What security model is based on dynamic changes of user privileges and access based on user activity? A. Sutherland B. Brewer-Nash C. Biba D. Graham-Denning The Brewer-Nash model is based on dynamic changes of user privileges and access based on user activity. Which one of the following storage devices is most likely to require encryption technology in order to maintain data security in a networked environment? A. Hard disk B. Backup tape C. Removable drives D. RAM C- Removable drives are easily taken out of their authorized physical location, and it is often not possible to apply operating system access controls to them. Therefore, encryption is often the only security measure short of physical security that can be afforded to them. Backup tapes are most often well controlled through physical security measures. Hard disks and RAM chips are often secured through operating system access controls. What type of access control system is deployed to physically deter unwanted or unauthorized activity and access? A. Preventive access control B. Deterrent access control C. Directive access control D. Compensation access control a-Preventive access control is deployed to stop unwanted or unauthorized activity from occurring. When attempting to impose accountability on users, what key issue must be addressed? A. Reliable log storage system B. Proper warning banner notification C. Legal defense/support of authentication D. Use of discretionary access control C-To effectively hold users accountable, your security must be legally defensible. Primarily, you must be able to prove in a court that your authentication process cannot be easily compromised. Thus, your audit trails of actions can then be tied to a human. Which of the following identifies vendor responsibilities and can include monetary penalties if the vendor doesn't meet the stated responsibilities? A. Service-level agreement (SLA) B. Memorandum of understanding (MOU) C. Interconnection security agreement (ISA) D. Software as a service (SaaS) a -A service-level agreement identifies responsibilities of a third party such as a vendor and can include monetary penalties if the vendor doesn't meet the stated responsibilities. A MOU is an informal agreement and does not include monetary penalties. An ISA defines requirements for establishing, maintaining, and disconnecting a connection. SaaS is one of the cloud-based service models and does not specify vendor responsibilities.