Online CISSP Test Brain Dump Question and Test Engine
Real ISC CISSP Exam Dumps with Correct 1481 Questions and Answers
To become a CISSP certified professional, candidates must pass the exam and meet certain experience requirements. CISSP exam consists of 250 multiple-choice questions, which must be completed within six hours. CISSP exam is computer-based and is offered in multiple languages, including English, French, German, Portuguese, and Spanish. The CISSP certification is valid for three years, after which candidates must recertify by earning Continuing Professional Education (CPE) credits.
NEW QUESTION # 75
In a quarterly system access review, an active privileged account was discovered that did not exist in the prior review on the production system. The account was created one hour after the previous access review. Which of the following is the BEST option to reduce overall risk in addition to quarterly access reviews?
- A. Implement and review risk-based alerts.
- B. Increase logging levels.
- C. Implement bi-annual reviews.
- D. Create policies for system access.
Answer: A
NEW QUESTION # 76
Which of the following choices describe a condition when RAM and Secondary storage are used together?
- A. Primary storage
- B. Secondary storage
- C. Real storage
- D. Virtual storage
Answer: D
Explanation:
Virtual storage a service provided by the operating system where it uses a combination of RAM and disk storage to simulate a much larger address space than is actually present. Infrequently used portions of memory are paged out by being written to secondary storage and paged back in when required by a running program.
Most OS's have the ability to simulate having more main memory than is physically available in the system. This is done by storing part of the data on secondary storage, such as a disk. This can be considered a virtual page. If the data requested by the system is not currently in main memory, a page fault is taken. This condition triggers the OS handler. If the virtual address is a valid one, the OS will locate the physical page, put the right information in that page, update the translation table, and then try the request again. Some other page might be swapped out to make room. Each process may have its own separate virtual address space along with its own mappings and protections.
The following are incorrect answers: Primary storage is incorrect. Primary storage refers to the combination of RAM, cache and the processor registers. Primary Storage The data waits for processing by the processors, it sits in a staging area called primary storage. Whether implemented as memory, cache, or registers (part of the CPU), and regardless of its location, primary storage stores data that has a high probability of
being requested by the CPU, so it is usually faster than long-term, secondary storage. The
location where data is stored is denoted by its physical memory address. This memory register
identifier remains constant and is independent of the value stored there. Some examples of
primary storage devices include random-access memory (RAM), synchronous dynamic random-
access memory (SDRAM), and read-only memory (ROM). RAM is volatile, that is, when the
system shuts down, it flushes the data in RAM although recent research has shown that data may
still be retrievable. Contrast this
Secondary storage is incorrect. Secondary storage holds data not currently being used by the
CPU and is used when data must be stored for an extended period of time using high-capacity,
nonvolatile storage. Secondary storage includes disk, floppies, CD's, tape, etc. While secondary
storage includes basically anything different from primary storage, virtual memory's use of
secondary storage is usually confined to high-speed disk storage.
Real storage is incorrect. Real storage is another word for primary storage and distinguishes
physical memory from virtual memory.
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition
((ISC)2 Press) (Kindle Locations 17164-17171). Auerbach Publications. Kindle Edition.
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition
((ISC)2 Press) (Kindle Locations 17196-17201). Auerbach Publications. Kindle Edition.
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition
((ISC)2 Press) (Kindle Locations 17186-17187). Auerbach Publications. Kindle Edition.
NEW QUESTION # 77
Which of the following OSI layers does not provide confidentiality?
- A. Session
- B. Transport
- C. Network
- D. Presentation
Answer: B
Explanation:
1.Reference: "[Network Layer] The routing protocols are located at this layer and include the following: .....Internet Protocol Security (IPSec)". "The following protocols operate within the Session layer: Secure Sockets Layer (SSL)". "The Presentation layer is also responsible for encryption and compression." Pg 61-62 Tittel: CISSP Study Guide
2.According to this chart:
http://en.wikipedia.org/wiki/OSI_model
Network - IPSEC
Presentation - SSL/TLS
Session - L2TP
Transport - remains an answer.
3. According to Shon Harris / CISSP 5th edition, SSL is at the TRANSPORT layer
Conclusion:
So, 3 different sources put SSL at 3 completely different layers. But using 1 of the 2 sources does get you with 'transport' as being the answer.
NEW QUESTION # 78
Which choice below is the BEST description of a Central Station Alarm
System?
- A. Also rings an alarm in the local fire or police station
- B. Rings an alarm in the office of the customer
- C. Rings an audible alarm on the local premises that it protects
- D. Rings an alarm in a central monitoring office of a third-party monitoring firm
Answer: D
Explanation:
Answer "Rings an audible alarm on the local premises that it protects" describes a Local
Alarm System.
Answer "Rings an alarm in the office of the customer" describes a Proprietary System.
Answer "Also rings an alarm in the local fire or police station" describes an Auxiliary Station System.
NEW QUESTION # 79
Which of the following is NOT an example of a detective control?
- A. IDS
- B. Backup data restore
- C. Monitor detector
- D. System Monitor
Answer: B
Explanation:
The word NOT is used as a keyword in the question. You need to find out a security control from an given options which in not detective control. Backup data restore is a corrective control and not a detective control.
For your exam you should know below information about different security controls
Deterrent Controls Deterrent Controls are intended to discourage a potential attacker. Access controls act as a deterrent to threats and attacks by the simple fact that the existence of the control is enough to keep some potential attackers from attempting to circumvent the control. This is often because the effort required to circumvent the control is far greater than the potential reward if the attacker is successful, or, conversely, the negative implications of a failed attack (or getting caught) outweigh the benefits of success. For example, by forcing the identification and authentication of a user, service, or application, and all that it implies, the potential for incidents associated with the system is significantly reduced because an attacker will fear association with the incident. If there are no controls for a given access path, the number of incidents and the potential impact become infinite. Controls inherently reduce exposure to risk by applying oversight for a process. This oversight acts as a deterrent, curbing an attacker's appetite in the face of probable repercussions. The best example of a deterrent control is demonstrated by employees and their propensity to intentionally perform unauthorized functions, leading to unwanted events. When users begin to understand that by authenticating into a system to perform a function, their activities are logged and monitored, and it reduces the likelihood they will attempt such an action. Many threats are based on the anonymity of the threat agent, and any potential for identification and association with their actions is avoided at all costs. It is this fundamental reason why access controls are the key target of circumvention by attackers. Deterrents also take the form of potential punishment if users do something unauthorized. For example, if the organization policy specifies that an employee installing an unauthorized wireless access point will be fired, that will determine most employees from installing wireless access points.
Preventative Controls Preventive controls are intended to avoid an incident from occurring. Preventative access controls keep a user from performing some activity or function. Preventative controls differ from deterrent controls in that the control is not optional and cannot (easily) be bypassed. Deterrent controls work on the theory that it is easier to obey the control rather than to risk the consequences of bypassing the control. In other words, the power for action resides with the user (or the attacker). Preventative controls place the power of action with the system, obeying the control is not optional. The only way to bypass the control is to find a flaw in the control's implementation.
Compensating Controls Compensating controls are introduced when the existing capabilities of a system do not support the requirement of a policy. Compensating controls can be technical, procedural, or managerial. Although an existing system may not support the required controls, there may exist other technology or processes that can supplement the existing environment, closing the gap in controls, meeting policy requirements, and reducing overall risk. For example, the access control policy may state that the authentication process must be encrypted when performed over the Internet. Adjusting an application to natively support encryption for authentication purposes may be too costly. Secure Socket Layer (SSL), an encryption protocol, can be employed and layered on top of the authentication process to support the policy statement. Other examples include a separation of duties environment, which offers the capability to isolate certain tasks to compensate for technical limitations in the system and ensure the security of transactions. In addition, management processes, such as authorization, supervision, and administration, can be used to compensate for gaps in the access control environment.
Detective Controls Detective controls warn when something has happened, and are the earliest point in the postincident timeline. Access controls are a deterrent to threats and can be aggressively utilized to prevent harmful incidents through the application of least privilege. However, the detective nature of access controls can provide significant visibility into the access environment and help organizations manage their access strategy and related security risk. As mentioned previously, strongly managed access privileges provided to an authenticated user offer the ability to reduce the risk exposure of the enterprise's assets by limiting the capabilities that authenticated user has. However, there are few options to control what a user can perform once privileges are provided. For example, if a user is provided write access to a file and that file is damaged, altered, or otherwise negatively impacted (either deliberately or unintentionally), the use of applied access controls will offer visibility into the transaction. The control environment can be established to log activity regarding the identification, authentication, authorization, and use of privileges on a system. This can be used to detect the occurrence of errors, the attempts to perform an unauthorized action, or to validate when provided credentials were exercised. The logging system as a detective device provides evidence of actions (both successful and unsuccessful) and tasks that were executed by authorized users.
Corrective Controls When a security incident occurs, elements within the security infrastructure may require corrective actions. Corrective controls are actions that seek to alter the security posture of an environment to correct any deficiencies and return the environment to a secure state. A security incident signals the failure of one or more directive, deterrent, preventative, or compensating controls. The detective controls may have triggered an alarm or notification, but now the corrective controls must work to stop the incident in its tracks. Corrective controls can take many forms, all depending on the particular situation at hand or the particular security failure that needs to be dealt with.
Recovery Controls Any changes to the access control environment, whether in the face of a security incident or to offer temporary compensating controls, need to be accurately reinstated and returned to normal operations. There are several situations that may affect access controls, their applicability, status, or management. Events can include system outages, attacks, project changes, technical demands, administrative gaps, and full-blown disaster situations. For example, if an application is not correctly installed or deployed, it may adversely affect controls placed on system files or even have default administrative accounts unknowingly implemented upon install. Additionally, an employee may be transferred, quit, or be on temporary leave that may affect policy requirements regarding separation of duties. An attack on systems may have resulted in the implantation of a Trojan horse program, potentially exposing private user information, such as credit card information and financial data. In all of these cases, an undesirable situation must be rectified as quickly as possible and controls returned to normal operations.
For your exam you should know below information about different security controls Deterrent Controls Deterrent Controls are intended to discourage a potential attacker. Access controls act as a deterrent to threats and attacks by the simple fact that the existence of the control is enough to keep some potential attackers from attempting to circumvent the control. This is often because the effort required to circumvent the control is far greater than the potential reward if the attacker is successful, or, conversely, the negative implications of a failed attack (or getting caught) outweigh the benefits of success. For example, by forcing the identification and authentication of a user, service, or application, and all that it implies, the potential for incidents associated with the system is significantly reduced because an attacker will fear association with the incident. If there are no controls for a given access path, the number of incidents and the potential impact become infinite. Controls inherently reduce exposure to risk by applying oversight for a process. This oversight acts as a deterrent, curbing an attacker's appetite in the face of probable repercussions.
The best example of a deterrent control is demonstrated by employees and their propensity to intentionally perform unauthorized functions, leading to unwanted events.
When users begin to understand that by authenticating into a system to perform a function, their activities are logged and monitored, and it reduces the likelihood they will attempt such an action. Many threats are based on the anonymity of the threat agent, and any potential for identification and association with their actions is avoided at all costs.
It is this fundamental reason why access controls are the key target of circumvention by attackers. Deterrents also take the form of potential punishment if users do something unauthorized. For example, if the organization policy specifies that an employee installing an unauthorized wireless access point will be fired, that will determine most employees from installing wireless access points.
Preventative Controls Preventive controls are intended to avoid an incident from occurring. Preventative access controls keep a user from performing some activity or function. Preventative controls differ from deterrent controls in that the control is not optional and cannot (easily) be bypassed. Deterrent controls work on the theory that it is easier to obey the control rather than to risk the consequences of bypassing the control. In other words, the power for action resides with the user (or the attacker). Preventative controls place the power of action with the system, obeying the control is not optional. The only way to bypass the control is to find a flaw in the control's implementation.
Compensating Controls Compensating controls are introduced when the existing capabilities of a system do not support the requirement of a policy. Compensating controls can be technical, procedural, or managerial.
Although an existing system may not support the required controls, there may exist other technology or processes that can supplement the existing environment, closing the gap in controls, meeting policy requirements, and reducing overall risk.
For example, the access control policy may state that the authentication process must be encrypted when performed over the Internet. Adjusting an application to natively support encryption for authentication purposes may be too costly. Secure Socket Layer (SSL), an encryption protocol, can be employed and layered on top of the authentication process to support the policy statement.
Other examples include a separation of duties environment, which offers the capability to isolate certain tasks to compensate for technical limitations in the system and ensure the security of transactions. In addition, management processes, such as authorization, supervision, and administration, can be used to compensate for gaps in the access control environment.
Detective Controls Detective controls warn when something has happened, and are the earliest point in the post-incident timeline. Access controls are a deterrent to threats and can be aggressively utilized to prevent harmful incidents through the application of least privilege. However, the detective nature of access controls can provide significant visibility into the access environment and help organizations manage their access strategy and related security risk.
As mentioned previously, strongly managed access privileges provided to an authenticated user offer the ability to reduce the risk exposure of the enterprise's assets by limiting the capabilities that authenticated user has. However, there are few options to control what a user can perform once privileges are provided. For example, if a user is provided write access to a file and that file is damaged, altered, or otherwise negatively impacted (either deliberately or unintentionally), the use of applied access controls will offer visibility into the transaction. The control environment can be established to log activity regarding the identification, authentication, authorization, and use of privileges on a system.
This can be used to detect the occurrence of errors, the attempts to perform an unauthorized action, or to validate when provided credentials were exercised. The logging system as a detective device provides evidence of actions (both successful and unsuccessful) and tasks that were executed by authorized users.
Corrective Controls When a security incident occurs, elements within the security infrastructure may require corrective actions. Corrective controls are actions that seek to alter the security posture of an environment to correct any deficiencies and return the environment to a secure state. A security incident signals the failure of one or more directive, deterrent, preventative, or compensating controls. The
detective controls may have triggered an alarm or notification, but now the corrective controls must
work to stop the incident in its tracks. Corrective controls can take many forms, all depending on
the particular situation at hand or the particular security failure that needs to be dealt with.
Recovery Controls
Any changes to the access control environment, whether in the face of a security incident or to
offer temporary compensating controls, need to be accurately reinstated and returned to normal
operations. There are several situations that may affect access controls, their applicability, status,
or management.
Events can include system outages, attacks, project changes, technical demands, administrative
gaps, and full-blown disaster situations. For example, if an application is not correctly installed or
deployed, it may adversely affect controls placed on system files or even have default
administrative accounts unknowingly implemented upon install.
Additionally, an employee may be transferred, quit, or be on temporary leave that may affect policy
requirements regarding separation of duties. An attack on systems may have resulted in the
implantation of a Trojan horse program, potentially exposing private user information, such as
credit card information and financial data. In all of these cases, an undesirable situation must be
rectified as quickly as possible and controls returned to normal operations.
The following answers are incorrect:
The other examples are belongs to detective control.
The following reference(s) were/was used to create this question:
CISA Review Manual 2014 Page number 44
and
Official ISC2 CISSP guide 3rd edition Page number 50 and 51
NEW QUESTION # 80
What type of test assesses a Disaster Recovery (DR) plan using realistic disaster scenarios while maintaining minimal impact to business operations?
- A. Tabletop
- B. Simulation
- C. Walkthrough
- D. Parallel
Answer: B
NEW QUESTION # 81
An organization needs a general purpose document to prove that its internal controls properly address security, availability, processing integrity, confidentiality or privacy risks. Which of the following reports is required?
- A. A Service Organization Control (SOC) 3 report
- B. A Service Organization Control (SOC) 2 report
- C. The Statement on Standards for Attestation Engagements No. 18 (SSAE 18)
- D. The International Organization for Standardization (ISO) 27001
Answer: B
NEW QUESTION # 82
Drag the following Security Engineering terms on the left to the BEST definition on the right.
Answer:
Explanation:
Explanation
NEW QUESTION # 83
Which of the following languages is NOT an object-oriented language?
- A. Smalltalk
- B. Lisp
- C. C++
- D. Simula 67
Answer: B
Explanation:
Lisp, for list processing, is a functional language that processes
symbolic expressions rather than numbers. It is used in the artificial
intelligence field. The languages cited in the other answers are
object-oriented languages.
NEW QUESTION # 84
Which of the following statements relating to the Bell-LaPadula security model is FALSE (assuming the Strong Star property is not being used)?
- A. A subject is not allowed to read up.
- B. A subject is not allowed to read down.
- C. The *- property restriction can be escaped by temporarily downgrading a high level subject.
- D. It is restricted to confidentiality.
Answer: B
Explanation:
Explanation/Reference:
Explanation:
The statement that a subject is not allowed to read down in the Bell-LaPadula security model is FALSE.
The Bell-LaPadula model was developed to make sure secrets stay secret; thus, it provides and addresses confidentiality only.
The Bell-LaPadula model is a subject-to-object model. An example would be how you (subject) could read a data element (object) from a specific database and write data into that database.
Three main rules are used and enforced in the Bell-LaPadula model: the simple security rule, the *- property (star property) rule, and the strong star property rule. The simple security rule states that a subject at a given security level cannot read data that reside at a higher security level. For example, if Bob is given the security clearance of secret, this rule states he cannot read data classified as top secret. If the organization wanted Bob to be able to read top-secret data, it would have given him that clearance in the first place.
The *-property rule (star property rule) states that a subject in a given security level cannot write information to a lower security level. The simple security rule is referred to as the "no read up" rule, and the *-property rule is referred to as the "no write down" rule. The third rule, the strong star property rule, states that a subject that has read and write capabilities can only perform those functions at the same security level; nothing higher and nothing lower. So, for a subject to be able to read and write to an object, the clearance and classification must be equal.
Incorrect Answers:
A: It is true that a subject is not allowed to read up in the Bell-LaPadula model.
B: It is true that the *- property restriction in the Bell-LaPadula model can be escaped by temporarily downgrading a high level subject.
D: It is true that the Bell-LaPadula model is restricted to confidentiality.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 369-372
NEW QUESTION # 85
What is known as the chance that someone other than you is granted access to your account?
- A. FAR
- B. ERR
- C. FRR
- D. MTBF
Answer: A
Explanation:
The FAR is the chance that someone other than you is granted access to your account, in other words, the probability that a non-mated comparison (i.e. two biometric samples of different fingers) match. FAR and FRR numbers are generally expressed in terms of probability.
Note:
false accept rate or false match rate (FAR or FMR): the probability that the system incorrectly matches the input pattern to a non-matching template in the database. It measures the percent of invalid inputs which are incorrectly accepted.
* false reject rate or false non-match rate (FRR or FNMR): the probability that the system fails to detect a match between the input pattern and a matching template in the database. It measures the percent of valid inputs which are incorrectly rejected. FRR is a Type 1 error FAR is a Type 2 error
NEW QUESTION # 86
What is the main concern with single sign-on?
- A. The security administrator's workload would increase.
- B. Maximum unauthorized access would be possible if a password is disclosed.
- C. User access rights would be increased.
- D. The users' password would be too hard to remember.
Answer: B
Explanation:
Explanation/Reference:
Explanation:
A major concern with Single Sign-On (SSO) is that if a user's ID and password are compromised, the intruder would have access to all the systems that the user was authorized for.
Incorrect Answers:
B: Since the security administrator would not be responsible for maintaining multiple user accounts just the one, the security administrator's workload would decrease and not increase.
C: Since users would only have one password to remember, it would not be hard.
D: User access rights would not be any different than if they had to log into systems manually.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 207-209
NEW QUESTION # 87
In steganography,
- A. Public key algorithms are used.
- B. Private key algorithms are used.
- C. Both public and private key algorithms are used.
- D. The fact that the message exists is not known.
Answer: D
Explanation:
The other answers are incorrect because neither algorithm is used.
NEW QUESTION # 88
Which of the following determines that the product developed meets the projects goals?
- A. validation
- B. concurrence
- C. verification
- D. accuracy
Answer: A
Explanation:
Software Development Verification vs. Validation:
Verification determines if the product accurately represents and meets the design specifications given to the developers. A product can be developed that does not match the original specifications. This step ensures that the specifications are properly met and closely followed by the development team.
Validation determines if the product provides the necessary solution intended real-world problem. It validates whether or not the final product is what the user expected in the first place and whether or not it solve the problem it intended to solve. In large projects, it is easy to lose sight of overall goal. This exercise ensures that the main goal of the project is met.
From DITSCAP:
6.3.2. Phase 2, Verification. The Verification phase shall include activities to verify compliance of the system with previously agreed security requirements. For each life-cycle development activity, DoD Directive 5000.1 (reference (i)), there is a corresponding set of security activities, enclosure 3, that shall verify compliance with the security requirements and evaluate vulnerabilities.
6.3.3. Phase 3, Validation. The Validation phase shall include activities to evaluate the fully integrated system to validate system operation in a specified computing environment with an acceptable level of residual risk. Validation shall culminate in an approval to operate.
NOTE:
DIACAP has replace DITSCAP but the definition above are still valid and applicable for the purpose of the exam.
Reference(s) used for this question:
Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (p. 1106). McGraw-
Hill. Kindle Edition.
and
http://iase.disa.mil/ditscap/DITSCAP.html
NEW QUESTION # 89
Compared to RSA, which of the following is true of Elliptic Curve Cryptography(ECC)?
- A. It has been mathematically proved to be more secure.
- B. It has been mathematically proved to be less secure.
- C. It is believed to require shorter keys for equivalent security.
- D. It is believed to require longer key for equivalent security.
Answer: C
Explanation:
The Answer: It is believed to require shorter keys for equivalent security.
Some experts believe that ECC with key length 160 bits is equivalent to RSA with key length 1024 bits.
The following answers are incorrect: It has been mathematically proved to be less secure.
ECC has not been proved to be more or less secure than RSA. Since ECC is newer than
RSA, it is considered riskier by some, but that is just a general assessment, not based on mathematical arguments.
It has been mathematically proved to be more secure. ECC has not been proved to be more or less secure than RSA. Since ECC is newer than RSA, it is considered riskier by some, but that is just a general assessment, not based on mathematical arguments.
It is believed to require longer key for equivalent security. On the contrary, it is believed to require shorter keys for equivalent security of RSA.
Shon Harris, AIO v5 pg719 states:
"In most cases, the longer the key, the more protection that is provided, but ECC can provide the same level of protection with a key size that is shorter that what RSA requires"
The following reference(s) were/was used to create this question:
ISC2 OIG, 2007 p. 258
Shon Harris, AIO v5 pg719
NEW QUESTION # 90
In addition to the accuracy of the biometric systems, there are other factors that must also be considered:
- A. These factors include the enrollment time and the throughput rate, but not acceptability.
- B. These factors do not include the enrollment time, the throughput rate, and acceptability.
- C. These factors include the enrollment time, but not the throughput rate, neither the acceptability.
- D. These factors include the enrollment time, the throughput rate, and acceptability.
Answer: D
Explanation:
In addition to the accuracy of the biometric systems, there are OTHER factors that must also be considered. These factors include the enrollment time, the throughput rate, and acceptability. -Ronald Krutz The CISSP PREP Guide (gold edition) pg 51
NEW QUESTION # 91
......
The Certified Information Systems Security Professional certification is awarded by the International Information System Security Certification Consortium, or ISC², a non-profit organization that aims to provide education and certification programs for information security professionals. The ISC CISSP certification is considered a benchmark for excellence in the field of information security and is highly sought after by employers around the world.
Valid CISSP Test Answers & ISC CISSP Exam PDF: https://www.prepawaypdf.com/ISC/CISSP-practice-exam-dumps.html
ISC CISSP Certification Real 2024 Mock Exam: https://drive.google.com/open?id=1D2nwLfDdzAFsWRn_p-ABJNtvijMWCGKZ