CISSP Cert Library Topic 5 Exam With
Complete Answers
Which of the following is true related to network sniffing?
A. Sniffers allow an attacker to monitor data passing across a network.
B. Sniffers alter the source address of a computer to disguise and exploit weak
authentication methods.
C. Sniffers take over network connections.
D. Sniffers send IP fragments to a system that overlap with each other. - ANSWER
Answer : A
Explanation: The following answers are incorrect: Sniffers alter the source address of a
computer to disguise and exploit weak authentication methods. IP Spoofing is a
network- based attack, which involves altering the source address of a computer to
disguise the attacker and exploit weak authentication methods. Sniffers take over
network connections. Session Hijacking tools allow an attacker to take over network
connections, kicking off the legitimate user or sharing a login. Sniffers send IP
fragments to a system that overlap with each other. Malformed Packet attacks are a
type of DoS attack that involves one or two packets that are formatted in an
unexpected way. Many vendor product implementations do not take into account all
variations of user entries or packet types. If software handles such errors poorly, the
system may crash when it receives such packets. A classic example of this type of
attack involves sending IP fragments to a system that overlap with each other (the
fragment offset values are incorrectly set. Some unpatched Windows and Linux
systems will crash when the encounter such packets. The following reference(s)
were/was used to create this question: Source: TIPTON, Harold F. & KRAUSE, MICKI,
Information Security Management Handbook, 4th Edition, Volume 2,
Auerbach, NY, NY 2001, Chapter 22, Hacker Tools and Techniques by Ed Skoudis.
ISC2 OIG, 2007 p. 137-138, 419
NEXT QUESTION
What is the main objective of proper separation of duties?
A. To prevent employees from disclosing sensitive information.
p
py
g
B. To ensure access controls are in place.
,C. To ensure that no single individual can compromise a system.
D. To ensure that audit trails are not tampered with. - ANSWER Answer : C
Explanation: The primary objective of proper separation of duties is to ensure that one
person acting alone cannot compromise the company's security in any way. A
proper separation of duties does not prevent employees from disclosing information, nor
does it ensure that access controls are in place or that audit trails are not
tampered with. Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide,
McGraw- Hill/Osborne, 2002, Chapter 12: Operations Security (Page 808).
NEXT QUESTION
Which of the following is true about a "dry pipe" sprinkler system?
A. It is a substitute for carbon dioxide systems.
B. It maximizes chances of accidental discharge of water.
C. It reduces the likelihood of the sprinkler system pipes freezing.
D. It uses less water than "wet pipe" systems. - ANSWER Answer : C
Explanation: A dry pipe system is used in areas where the water in the pipes is subject
to freezing, and to minimize the chances of accidental discharge of water if the
pipes would freeze in the winter time, and It minimizes chances of accidental discharge
of water as well by not releasing the water until the pressure in the pipe would
drop due to one of the sprinkler head being opened. A Dry Pipe system has the water
being held back from charging the sprinkler pipe system by a special kind of check
valve called a "dry pipe valve" or "clapper valve". A dry pipe system is also a system
which the pipes are filled with pressurized air or nitrogen rather than water. The
air uses a mechanical advantage which holds back a device known as a dry pipe valve
or clapper valve that prevent the water from getting into the pipe when it is
pressurized. A small amount of water, called priming water, is also inside the dry pipe
system, which is filled with either air or nitrogen under pressure. The sprinkler
pipe system is filled with pressurized air or nitrogen, which keeps the dry pipe valve
closed using mechanical advantage. When any of the sprinkler valves open, the
pressurized air or nitrogen is released, and the dropping pressure permits the dry pipe
valve to open. It's primary use is to protect the sprinkler pipes from freezing. A
Wet Pipe system has the pipes always charged with water, and the thermal-fusible link
in each sprinkler head is holding back the water. If any sprinkler head is exposed
to enough heat, for long enough, the link will break/melt and water will be discharged. A
wet pipe system is generally used when there is no danger of the water in the
pipes freezing or when there are no special conditions that require a special purpose
sprinkler system. A Preaction Pipe system is used where accidental activa
Which of the following computer crime is MORE often associated with INSIDERS?
A. IP spoofing
B. Password sniffing
C. Data diddling
D. Denial of service (DOS) - ANSWER Answer : C
,Explanation: It refers to the alteration of the existing data , most often seen before it is
entered into an application.This type of crime is extremely common and can be
prevented by using appropriate access controls and proper segregation of duties. It will
more likely be perpetrated by insiders, who have access to data before it is
processed. The other answers are incorrect because : IP Spoofing is not correct as the
questions asks about the crime associated with the insiders. Spoofing is generally
accomplished from the outside. Password sniffing is also not the BEST answer as it
requires a lot of technical knowledge in understanding the encryption and
decryption process. Denial of service (DOS) is also incorrect as most Denial of service
attacks occur over the internet. Reference : Shon Harris , AIO v3 , Chapter-10 :
Law , Investigation & Ethics , Page : 758- 760.
NEXT QUESTION
Ensuring that printed reports reach proper users and that receipts are signed before
releasing sensitive documents are examples of:
A. Deterrent controls
B. Output controls
C. Information flow controls
D. Asset controls - ANSWER Answer : B
Explanation: Output controls are used for two things: for verifying the integrity and
protecting the confidentiality of an output. These are examples of proper output
controls. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide:
Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001,
Chapter 6: Operations Security (page 218).
NEXT QUESTION
Which of the following is the most reliable, secure means of removing data from
magnetic
storage media such as a magnetic tape, or a cassette?
A. Degaussing
B. Parity Bit Manipulation
C. Zeroization
D. Buffer overflow - ANSWER Answer : A
Explanation: A "Degausser (Otherwise known as a Bulk Eraser) has the main function
of reducing to near zero the magnetic flux stored in the magnetized medium.
Flux density is measured in Gauss or Tesla. The operation is speedier than overwriting
and done in one short operation. This is achieved by subjecting the subject in
bulk to a series of fields of alternating polarity and gradually decreasing strength. The
following answers are incorrect:Parity Bit Manipulation. Parity has to do with
disk lerror detection, not data removal. A bit or series of bits appended to a character or
block of characters to ensure that the information received is the same as the
infromation that was sent. Zeroization. Zeroization involves overwrting data to sanitize it.
It is time-consuming and not foolproof. The potential of restoration of data
does exist with this method. Buffer overflow. This is a detractor. Although many
Operating Systems use a disk buffer to temporarily hold data read from disk, its
, primary purpose has no connection to data removal. An overflow goes outside the
constraints defined for the buffer and is a method used by an attacker to attempt
access to a system. The following reference(s) were/was used to create this question:
Shon Harris AIO v3. pg 908 Reference: What is degaussing.
NEXT QUESTION
Which of the following method is recommended by security professional to
PERMANENTLY erase sensitive data on magnetic media?
A. Degaussing
B. Overwrite every sector of magnetic media with pattern of 1's and 0's
C. Format magnetic media
D. Delete File allocation table - ANSWER Answer : A
Explanation: PERMANENTLY is the keyword used in the question. You need to find out
data removal method which remove data permanently from magnetic media.
Degaussing is the most effective method out of all provided choices to erase sensitive
data on magnetic media provided magnetic media is not require to be reuse. Some
degaussers can destroy drives. The security professional should exercise caution when
recommending or using degaussers on media for reuse. A device that performs
degaussing generates a coercive magnetic force that reduces the magnetic flux density
of the storage media to zero. This magnetic force is what properly erases data
from media. Data are stored on magnetic media by the representation of the
polarization of the atoms. Degaussing changes this polarization (magnetic alignment) by
using a type of large magnet to bring it back to its original flux (magnetic alignment). For
your exam you should know the information below: When media is to be
reassigned (a form of object reuse), it is important that all residual data is carefully
removed. Simply deleting files or formatting the media does not actually remove the
information. File deletion and media formatting often simply remove the pointers to the
information. Providing assurance for object reuse requires specialized tools and
techniques according to the type of media on which the data resides. Specialized
hardware devices known as degaussers can be used to erase data saved to magnetic
media. The measure of the amount of energy needed to reduce the magnetic field on
the media to zero is known as coercivity. It is important to make sure that the
coercivity of the degausser is of sufficient strength to meet object reuse requirements
when erasing data. If a degausser is used with insufficient coercivity, then a
remanence of the data will exist.
Which of the following answers best describes the type of penetration testing where the
analyst has full knowledge of the network on which he is going to perform his test?
A. White-Box Penetration Testing
B. Black-Box Pen Testing
C. Penetration Testing
D. Gray-Box Pen Testing - ANSWER Answer : A
Explanation: In general there are three ways a pen tester can test a target system. -
White-Box: The tester has full access and is testing from inside the system. - Gray-
Box: The tester has some knowledge of the system he's testing. - Black-Box: The tester
has no knowledge of the system. Each of these forms of testing has different
Complete Answers
Which of the following is true related to network sniffing?
A. Sniffers allow an attacker to monitor data passing across a network.
B. Sniffers alter the source address of a computer to disguise and exploit weak
authentication methods.
C. Sniffers take over network connections.
D. Sniffers send IP fragments to a system that overlap with each other. - ANSWER
Answer : A
Explanation: The following answers are incorrect: Sniffers alter the source address of a
computer to disguise and exploit weak authentication methods. IP Spoofing is a
network- based attack, which involves altering the source address of a computer to
disguise the attacker and exploit weak authentication methods. Sniffers take over
network connections. Session Hijacking tools allow an attacker to take over network
connections, kicking off the legitimate user or sharing a login. Sniffers send IP
fragments to a system that overlap with each other. Malformed Packet attacks are a
type of DoS attack that involves one or two packets that are formatted in an
unexpected way. Many vendor product implementations do not take into account all
variations of user entries or packet types. If software handles such errors poorly, the
system may crash when it receives such packets. A classic example of this type of
attack involves sending IP fragments to a system that overlap with each other (the
fragment offset values are incorrectly set. Some unpatched Windows and Linux
systems will crash when the encounter such packets. The following reference(s)
were/was used to create this question: Source: TIPTON, Harold F. & KRAUSE, MICKI,
Information Security Management Handbook, 4th Edition, Volume 2,
Auerbach, NY, NY 2001, Chapter 22, Hacker Tools and Techniques by Ed Skoudis.
ISC2 OIG, 2007 p. 137-138, 419
NEXT QUESTION
What is the main objective of proper separation of duties?
A. To prevent employees from disclosing sensitive information.
p
py
g
B. To ensure access controls are in place.
,C. To ensure that no single individual can compromise a system.
D. To ensure that audit trails are not tampered with. - ANSWER Answer : C
Explanation: The primary objective of proper separation of duties is to ensure that one
person acting alone cannot compromise the company's security in any way. A
proper separation of duties does not prevent employees from disclosing information, nor
does it ensure that access controls are in place or that audit trails are not
tampered with. Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide,
McGraw- Hill/Osborne, 2002, Chapter 12: Operations Security (Page 808).
NEXT QUESTION
Which of the following is true about a "dry pipe" sprinkler system?
A. It is a substitute for carbon dioxide systems.
B. It maximizes chances of accidental discharge of water.
C. It reduces the likelihood of the sprinkler system pipes freezing.
D. It uses less water than "wet pipe" systems. - ANSWER Answer : C
Explanation: A dry pipe system is used in areas where the water in the pipes is subject
to freezing, and to minimize the chances of accidental discharge of water if the
pipes would freeze in the winter time, and It minimizes chances of accidental discharge
of water as well by not releasing the water until the pressure in the pipe would
drop due to one of the sprinkler head being opened. A Dry Pipe system has the water
being held back from charging the sprinkler pipe system by a special kind of check
valve called a "dry pipe valve" or "clapper valve". A dry pipe system is also a system
which the pipes are filled with pressurized air or nitrogen rather than water. The
air uses a mechanical advantage which holds back a device known as a dry pipe valve
or clapper valve that prevent the water from getting into the pipe when it is
pressurized. A small amount of water, called priming water, is also inside the dry pipe
system, which is filled with either air or nitrogen under pressure. The sprinkler
pipe system is filled with pressurized air or nitrogen, which keeps the dry pipe valve
closed using mechanical advantage. When any of the sprinkler valves open, the
pressurized air or nitrogen is released, and the dropping pressure permits the dry pipe
valve to open. It's primary use is to protect the sprinkler pipes from freezing. A
Wet Pipe system has the pipes always charged with water, and the thermal-fusible link
in each sprinkler head is holding back the water. If any sprinkler head is exposed
to enough heat, for long enough, the link will break/melt and water will be discharged. A
wet pipe system is generally used when there is no danger of the water in the
pipes freezing or when there are no special conditions that require a special purpose
sprinkler system. A Preaction Pipe system is used where accidental activa
Which of the following computer crime is MORE often associated with INSIDERS?
A. IP spoofing
B. Password sniffing
C. Data diddling
D. Denial of service (DOS) - ANSWER Answer : C
,Explanation: It refers to the alteration of the existing data , most often seen before it is
entered into an application.This type of crime is extremely common and can be
prevented by using appropriate access controls and proper segregation of duties. It will
more likely be perpetrated by insiders, who have access to data before it is
processed. The other answers are incorrect because : IP Spoofing is not correct as the
questions asks about the crime associated with the insiders. Spoofing is generally
accomplished from the outside. Password sniffing is also not the BEST answer as it
requires a lot of technical knowledge in understanding the encryption and
decryption process. Denial of service (DOS) is also incorrect as most Denial of service
attacks occur over the internet. Reference : Shon Harris , AIO v3 , Chapter-10 :
Law , Investigation & Ethics , Page : 758- 760.
NEXT QUESTION
Ensuring that printed reports reach proper users and that receipts are signed before
releasing sensitive documents are examples of:
A. Deterrent controls
B. Output controls
C. Information flow controls
D. Asset controls - ANSWER Answer : B
Explanation: Output controls are used for two things: for verifying the integrity and
protecting the confidentiality of an output. These are examples of proper output
controls. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide:
Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001,
Chapter 6: Operations Security (page 218).
NEXT QUESTION
Which of the following is the most reliable, secure means of removing data from
magnetic
storage media such as a magnetic tape, or a cassette?
A. Degaussing
B. Parity Bit Manipulation
C. Zeroization
D. Buffer overflow - ANSWER Answer : A
Explanation: A "Degausser (Otherwise known as a Bulk Eraser) has the main function
of reducing to near zero the magnetic flux stored in the magnetized medium.
Flux density is measured in Gauss or Tesla. The operation is speedier than overwriting
and done in one short operation. This is achieved by subjecting the subject in
bulk to a series of fields of alternating polarity and gradually decreasing strength. The
following answers are incorrect:Parity Bit Manipulation. Parity has to do with
disk lerror detection, not data removal. A bit or series of bits appended to a character or
block of characters to ensure that the information received is the same as the
infromation that was sent. Zeroization. Zeroization involves overwrting data to sanitize it.
It is time-consuming and not foolproof. The potential of restoration of data
does exist with this method. Buffer overflow. This is a detractor. Although many
Operating Systems use a disk buffer to temporarily hold data read from disk, its
, primary purpose has no connection to data removal. An overflow goes outside the
constraints defined for the buffer and is a method used by an attacker to attempt
access to a system. The following reference(s) were/was used to create this question:
Shon Harris AIO v3. pg 908 Reference: What is degaussing.
NEXT QUESTION
Which of the following method is recommended by security professional to
PERMANENTLY erase sensitive data on magnetic media?
A. Degaussing
B. Overwrite every sector of magnetic media with pattern of 1's and 0's
C. Format magnetic media
D. Delete File allocation table - ANSWER Answer : A
Explanation: PERMANENTLY is the keyword used in the question. You need to find out
data removal method which remove data permanently from magnetic media.
Degaussing is the most effective method out of all provided choices to erase sensitive
data on magnetic media provided magnetic media is not require to be reuse. Some
degaussers can destroy drives. The security professional should exercise caution when
recommending or using degaussers on media for reuse. A device that performs
degaussing generates a coercive magnetic force that reduces the magnetic flux density
of the storage media to zero. This magnetic force is what properly erases data
from media. Data are stored on magnetic media by the representation of the
polarization of the atoms. Degaussing changes this polarization (magnetic alignment) by
using a type of large magnet to bring it back to its original flux (magnetic alignment). For
your exam you should know the information below: When media is to be
reassigned (a form of object reuse), it is important that all residual data is carefully
removed. Simply deleting files or formatting the media does not actually remove the
information. File deletion and media formatting often simply remove the pointers to the
information. Providing assurance for object reuse requires specialized tools and
techniques according to the type of media on which the data resides. Specialized
hardware devices known as degaussers can be used to erase data saved to magnetic
media. The measure of the amount of energy needed to reduce the magnetic field on
the media to zero is known as coercivity. It is important to make sure that the
coercivity of the degausser is of sufficient strength to meet object reuse requirements
when erasing data. If a degausser is used with insufficient coercivity, then a
remanence of the data will exist.
Which of the following answers best describes the type of penetration testing where the
analyst has full knowledge of the network on which he is going to perform his test?
A. White-Box Penetration Testing
B. Black-Box Pen Testing
C. Penetration Testing
D. Gray-Box Pen Testing - ANSWER Answer : A
Explanation: In general there are three ways a pen tester can test a target system. -
White-Box: The tester has full access and is testing from inside the system. - Gray-
Box: The tester has some knowledge of the system he's testing. - Black-Box: The tester
has no knowledge of the system. Each of these forms of testing has different
