CISSP Official Practice Questions Practice Test 3 with
Answers.
Fred's data role requires him to maintain system security plans and to ensure that system
users and support staff get the training they need about security practices and acceptable
use. What is the role that Fred is most likely to hold in the organization?
A. Data owner
B. System owner
C. User
D. Custodian - Correct Answer B. NIST SP800-18 describes system owner
responsibilities that include helping to develop system security plans, maintaining the
plan, ensuring training, and identifying, implementing, and assessing security controls.
A data owner is more likely to delegate these tasks to the system owner.
Custodians may be asked to enforce those controls, whereas a user will be directly
affected by them.
Sally is using IPsec's ESP component in transport mode. What important information
should she be aware of about transport mode?
A. Transport mode provides full encryption of the entire IP packet.
B. Transport mode adds a new, unencrypted header to ensure that packets reach their
destination.
C. Transport mode does not encrypt the header of the packet.
D. Transport mode provides no encryption; only tunnel mode provides encryption -
Correct Answer C. ESP's Transport mode encrypts IP packet data but leaves the packet
header unencrypted.
Tunnel mode encrypts the entire packet and adds a new header to support transmission
through the tunnel.
Which one of the following is not an essential process area for the Repeatable phase of
the Software Capability Maturity Model (SW-CMM)?
A. Software Project Planning
B. Software Quality Management
C. Software Project Tracking
,D. Software Subcontract Management - Correct Answer B. In level 2, the Repeatable
level of the SW-CMM, an organization introduces basic lifecycle management processes.
Reuse of code in an organized fashion begins, and repeatable results are expected from
similar projects.
The crucial process areas for this level include Requirements Management, Software
Project Planning, Software Project Tracking and Oversight, Software Subcontract
Management, Software Quality Assurance, and Software Configuration Management.
Software Quality Management is a process that occurs during level 4, the Managed stage
of the SW-CMM.
Ben wants to provide predictive information about his organization's risk exposure in an
automated way as part of an ongoing organizational risk management plan. What should
he use to do this?
A. KRIs
B. Quantitative risk assessments
C. KPIs
D. Penetration tests - Correct Answer A. Key risk indicators (KRIs) are often used to
monitor risk for organizations that establish an ongoing risk management program.
Using automated data gathering and tools that allow data to be digested and summarized
can provide predictive information about how organizational risks are changing.
KPIs are key performance indicators, which are used to assess how an organization is
performing.
Quantitative risk assessments are good for point-in-time views with detailed valuation and
measurement-based risk assessments, whereas a penetration test would provide details
of how well an organization's security controls are working.
In the image shown here, what does system B send to system A at step 2 of the three-way
TCP handshake?
A. SYN
B. ACK
C. FIN/ACK
D. SYN/ACK - Correct Answer D. The three-way handshake is SYN, SYN/ACK, ACK.
System B should respond with "Synchronize and Acknowledge" to System A after it
receives a SYN.
,Chris is conducting reconnaissance on a remote target and discovers that pings are
allowed through his target's border firewall. What can he learn by using ping to probe the
remote network?
A. Which systems respond to ping, a rough network topology, and potentially the location
of additional firewalls
B. A list of all of the systems behind the target's firewall
C. The hostnames and time to live (TTL) for each pingable system, and the ICMP types
allowed through the firewall
D. Router advertisements, echo request responses, and potentially which hosts are
tarpitted - Correct Answer A. Systems that respond to ping will show the time to live for
packets that reach them.
Since TTL is decremented at each hop, this can help build a rough network topology map.
In addition, some firewalls respond differently to ping than a normal system, which means
pinging a network can sometimes reveal the presence of firewalls that would otherwise be
invisible.
Hostnames are revealed by a DNS lookup, and ICMP types allowed through a firewall are
not revealed by only performing a ping.
ICMP can be used for router advertisements, but pinging won't show them!
Jake is conducting a review of his organization's identity and access management
program. During his review, he is verifying the privileges assigned to each user and
ensuring that they match with business requirements. What element of the program is he
reviewing?
A. Identification
B. Accountability
C. Authorization
D. Authentication - Correct Answer C. Authorization defines what a subject can or can't
do.
Identification occurs when a subject claims an identity,
accountability is provided by the logs and audit trail that track what occurs on a system,
and authentication occurs when that identity is validated.
, Faith is looking at the /etc/passwd file on a system configured to use shadowed
passwords. When she examines a line in the file for a user with interactive login
permissions, what should she expect to see in the password field?
A. Plaintext password
B. Hashed password
C. x
D. * - Correct Answer C. When a system uses shadowed passwords, the hashed
password value is stored in /etc/ shadow instead of /etc/passwd.
The /etc/passwd file would not contain the password in plaintext or hashed form.
Instead, it would contain an x to indicate that the password hash is in the shadow file.
The * character is normally used to disable interactive logins to an account.
Berta is analyzing the logs of the Windows Firewall on one of her servers and comes
across the entries shown in this figure. What type of attack do these entries indicate?
A. SQL injection
B. Port scan
C. Teardrop
D. Land - Correct Answer B. The log entries show the characteristic pattern of a port scan.
The attacking system sends connection attempts to the target system against a series of
commonly used ports
Danielle is testing tax software, and part of her testing process requires her to input a
variety of actual tax forms to verify that the software produces the right answers. What
type of testing is Danielle performing?
A. Use case testing
B. Dynamic testing
C. Fuzzing
D. Misuse testing - Correct Answer A. Testing for desired functionality is use case testing.
Dynamic testing is used to determine how code handles variables that change over time.
Misuse testing focuses on how code handles examples of misuse,
and fuzzing feeds unexpected data as an input to see how the code responds.
Answers.
Fred's data role requires him to maintain system security plans and to ensure that system
users and support staff get the training they need about security practices and acceptable
use. What is the role that Fred is most likely to hold in the organization?
A. Data owner
B. System owner
C. User
D. Custodian - Correct Answer B. NIST SP800-18 describes system owner
responsibilities that include helping to develop system security plans, maintaining the
plan, ensuring training, and identifying, implementing, and assessing security controls.
A data owner is more likely to delegate these tasks to the system owner.
Custodians may be asked to enforce those controls, whereas a user will be directly
affected by them.
Sally is using IPsec's ESP component in transport mode. What important information
should she be aware of about transport mode?
A. Transport mode provides full encryption of the entire IP packet.
B. Transport mode adds a new, unencrypted header to ensure that packets reach their
destination.
C. Transport mode does not encrypt the header of the packet.
D. Transport mode provides no encryption; only tunnel mode provides encryption -
Correct Answer C. ESP's Transport mode encrypts IP packet data but leaves the packet
header unencrypted.
Tunnel mode encrypts the entire packet and adds a new header to support transmission
through the tunnel.
Which one of the following is not an essential process area for the Repeatable phase of
the Software Capability Maturity Model (SW-CMM)?
A. Software Project Planning
B. Software Quality Management
C. Software Project Tracking
,D. Software Subcontract Management - Correct Answer B. In level 2, the Repeatable
level of the SW-CMM, an organization introduces basic lifecycle management processes.
Reuse of code in an organized fashion begins, and repeatable results are expected from
similar projects.
The crucial process areas for this level include Requirements Management, Software
Project Planning, Software Project Tracking and Oversight, Software Subcontract
Management, Software Quality Assurance, and Software Configuration Management.
Software Quality Management is a process that occurs during level 4, the Managed stage
of the SW-CMM.
Ben wants to provide predictive information about his organization's risk exposure in an
automated way as part of an ongoing organizational risk management plan. What should
he use to do this?
A. KRIs
B. Quantitative risk assessments
C. KPIs
D. Penetration tests - Correct Answer A. Key risk indicators (KRIs) are often used to
monitor risk for organizations that establish an ongoing risk management program.
Using automated data gathering and tools that allow data to be digested and summarized
can provide predictive information about how organizational risks are changing.
KPIs are key performance indicators, which are used to assess how an organization is
performing.
Quantitative risk assessments are good for point-in-time views with detailed valuation and
measurement-based risk assessments, whereas a penetration test would provide details
of how well an organization's security controls are working.
In the image shown here, what does system B send to system A at step 2 of the three-way
TCP handshake?
A. SYN
B. ACK
C. FIN/ACK
D. SYN/ACK - Correct Answer D. The three-way handshake is SYN, SYN/ACK, ACK.
System B should respond with "Synchronize and Acknowledge" to System A after it
receives a SYN.
,Chris is conducting reconnaissance on a remote target and discovers that pings are
allowed through his target's border firewall. What can he learn by using ping to probe the
remote network?
A. Which systems respond to ping, a rough network topology, and potentially the location
of additional firewalls
B. A list of all of the systems behind the target's firewall
C. The hostnames and time to live (TTL) for each pingable system, and the ICMP types
allowed through the firewall
D. Router advertisements, echo request responses, and potentially which hosts are
tarpitted - Correct Answer A. Systems that respond to ping will show the time to live for
packets that reach them.
Since TTL is decremented at each hop, this can help build a rough network topology map.
In addition, some firewalls respond differently to ping than a normal system, which means
pinging a network can sometimes reveal the presence of firewalls that would otherwise be
invisible.
Hostnames are revealed by a DNS lookup, and ICMP types allowed through a firewall are
not revealed by only performing a ping.
ICMP can be used for router advertisements, but pinging won't show them!
Jake is conducting a review of his organization's identity and access management
program. During his review, he is verifying the privileges assigned to each user and
ensuring that they match with business requirements. What element of the program is he
reviewing?
A. Identification
B. Accountability
C. Authorization
D. Authentication - Correct Answer C. Authorization defines what a subject can or can't
do.
Identification occurs when a subject claims an identity,
accountability is provided by the logs and audit trail that track what occurs on a system,
and authentication occurs when that identity is validated.
, Faith is looking at the /etc/passwd file on a system configured to use shadowed
passwords. When she examines a line in the file for a user with interactive login
permissions, what should she expect to see in the password field?
A. Plaintext password
B. Hashed password
C. x
D. * - Correct Answer C. When a system uses shadowed passwords, the hashed
password value is stored in /etc/ shadow instead of /etc/passwd.
The /etc/passwd file would not contain the password in plaintext or hashed form.
Instead, it would contain an x to indicate that the password hash is in the shadow file.
The * character is normally used to disable interactive logins to an account.
Berta is analyzing the logs of the Windows Firewall on one of her servers and comes
across the entries shown in this figure. What type of attack do these entries indicate?
A. SQL injection
B. Port scan
C. Teardrop
D. Land - Correct Answer B. The log entries show the characteristic pattern of a port scan.
The attacking system sends connection attempts to the target system against a series of
commonly used ports
Danielle is testing tax software, and part of her testing process requires her to input a
variety of actual tax forms to verify that the software produces the right answers. What
type of testing is Danielle performing?
A. Use case testing
B. Dynamic testing
C. Fuzzing
D. Misuse testing - Correct Answer A. Testing for desired functionality is use case testing.
Dynamic testing is used to determine how code handles variables that change over time.
Misuse testing focuses on how code handles examples of misuse,
and fuzzing feeds unexpected data as an input to see how the code responds.
