PASS - TAKER : Anonymos

Official (ISC)² CISSP Study Guide, Eighth Edition 2018 - Assessment Test

Correct : 25

62% Complete (success)

62 %

False : 15

37% Complete (success)

37 %



Anonymos 2019-11-20T08:32:26

Correct

Which of the following types of access control seeks to discover evidence of unwanted, unauthorized, or illicit behavior or activity?

Detective access controls are used to discover (and document) unwanted or unauthorized activity.

Correct

Define and detail the aspects of password selection that distinguish good password choices from ultimately poor password choices.

Strong password choices are difficult to guess, unpredictable, and of specified minimum lengths to ensure that password entries cannot be computationally determined. They may be randomly generated and utilize all the alphabetic, numeric, and punctuation characters; they should never be written down or shared; they should not be stored in publicly accessible or generally readable locations; and they shouldn’t be transmitted in the clear.

Correct

Which of the following is most likely to detect DoS attacks?

Network-based IDSs are usually able to detect the initiation of an attack or the ongoing attempts to perpetrate an attack (including denial of service, or DoS). They are, however, unable to provide information about whether an attack was successful or which specific systems, user accounts, files, or applications were affected. Host-based IDSs have some difficulty with detecting and tracking down DoS attacks. Vulnerability scanners don’t detect DoS attacks; they test for possible vulnerabilities. Penetration testing may cause a DoS or test for DoS vulnerabilities, but it is not a detection tool.

Correct

Which of the following is considered a denial-of-service attack?

Not all instances of DoS are the result of a malicious attack. Errors in coding OSs, services, and applications have resulted in DoS conditions. Some examples of this include a process failing to release control of the CPU or a service consuming system resources out of proportion to the service requests it is handling. Social engineering and sniffing are typically not considered DoS attacks.

Not Correct

At which layer of the OSI model does a router operate?

Network hardware devices, including routers, function at layer 3, the Network layer.

Correct

Which type of firewall automatically adjusts its filtering rules based on the content of the traffic of existing sessions?

Dynamic packet-filtering firewalls enable the real-time modification of the filtering rules based on traffic content.

Correct

A VPN can be established over which of the following?

A VPN link can be established over any other network communication connection. This could be a typical LAN cable connection, a wireless LAN connection, a remote access dial-up connection, a WAN link, or even an internet connection used by a client for access to the office LAN.

Correct

What type of malware uses social engineering to trick a victim into installing it?

A Trojan horse is a form of malware that uses social engineering tactics to trick a victim into installing it—the trick is to make the victim believe that the only thing they have downloaded or obtained is the host file, when in fact it has a malicious hidden payload.

Not Correct

The CIA Triad comprises what elements?

The components of the CIA Triad are confidentiality, availability, and integrity.

Correct

Which of the following is not a required component in the support of accountability?

Privacy is not necessary to provide accountability.

Not Correct

Which of the following is not a defense against collusion?

Group user accounts allow for multiple people to log in under a single user account. This allows collusion because it prevents individual accountability.

Not Correct

A data custodian is responsible for securing resources after _________________ has assigned the resource a security label.

The data owner must first assign a security label to a resource before the data custodian can secure the resource appropriately.

Not Correct

In what phase of the Capability Maturity Model for Software (SW-CMM) are quantitative measures utilized to gain a detailed understanding of the software development process?

The Managed phase of the SW-CMM involves the use of quantitative development metrics. The Software Engineering Institute (SEI) defines the key process areas for this level as Quantitative Process Management and Software Quality Management.

Not Correct

Which one of the following is a layer of the ring protection scheme that is not normally implemented in practice?

Layers 1 and 2 contain device drivers but are not normally implemented in practice. Layer 0 always contains the security kernel. Layer 3 contains user applications. Layer 4 does not exist.

Correct

What is the last phase of the TCP/IP three-way handshake sequence?

The SYN packet is first sent from the initiating host to the destination host. The destination host then responds with a SYN/ACK packet. The initiating host sends an ACK packet, and the connection is then established.

Correct

Which one of the following vulnerabilities would best be countered by adequate parameter checking?

Parameter checking is used to prevent the possibility of buffer overflow attacks.

Not Correct

What is the value of the logical operation shown here? X: 0 1 1 0 1 0 Y: 0 0 1 1 0 1 _________________ X ? Y: ?

The ~ OR symbol represents the OR function, which is true when one or both of the input bits are true.

Not Correct

In what type of cipher are the letters of the plain-text message rearranged to form the cipher text?

Transposition ciphers use an encryption algorithm to rearrange the letters of the plaintext message to form a cipher text message.

Correct

What is the length of a message digest produced by the MD5 algorithm?

The MD5 algorithm produces a 128-bit message digest for any input.

Correct

If Renee receives a digitally signed message from Mike, what key does she use to verify that the message truly came from Mike?

Any recipient can use Mike’s public key to verify the authenticity of the digital signature.

Not Correct

Which of the following is not a composition theory related to security models?

Iterative is not one of the composition theories related to security models. Cascading, feedback, and hookup are the three composition theories.

Correct

The collection of components in the TCB that work together to implement reference monitor functions is called the ____________________ .

The collection of components in the TCB that work together to implement reference monitor functions is called the security kernel.

Correct

Which of the following statements is true?

The more complex a system, the less assurance it provides. More complexity means more areas for vulnerabilities to exist and more areas that must be secured against threats. More vulnerabilities and more threats mean that the subsequent security provided by the system is less trustworthy.

Not Correct

Ring 0, from the design architecture security mechanism known as protection rings, can also be referred to as all but which of the following?

Ring 0 has direct access to the most resources; thus user mode is not an appropriate label because user mode requires restrictions to limit access to resources.

Not Correct

Audit trails, logs, CCTV, intrusion detection systems, antivirus software, penetration testing, password crackers, performance monitoring, and cyclic redundancy checks (CRCs) are examples of what?

Examples of detective controls are audit trails, logs, CCTV, intrusion detection systems, antivirus software, penetration testing, password crackers, performance monitoring, and CRCs.

Not Correct

System architecture, system integrity, covert channel analysis, trusted facility management, and trusted recovery are elements of what security criteria?

Assurance is the degree of confidence you can place in the satisfaction of security needs of a computer, network, solution, and so on. Operational assurance focuses on the basic features and architecture of a system that lend themselves to supporting security.

Correct

Which of the following is a procedure designed to test and perhaps bypass a system’s security controls?

Penetration testing is the attempt to bypass security controls to test overall system security.

Correct

Auditing is a required factor to sustain and enforce what?

Auditing is a required factor to sustain and enforce accountability.

Correct

What is the formula used to compute the ALE?

The annualized loss expectancy (ALE) is computed as the product of the asset value (AV) times the exposure factor (EF) times the annualized rate of occurrence (ARO). This is the longer form of the formula ALE = SLE * ARO. The other formulas displayed here do not accurately reflect this calculation.

Correct

What is the first step of the business impact assessment process?

Identification of priorities is the first step of the business impact assessment process.

Correct

Which of the following represent natural events that can pose a threat or risk to an organization?

Natural events that can threaten organizations include earthquakes, floods, hurricanes, tornados, wildfires, and other acts of nature as well. Thus options A, B, and C are correct because they are natural and not man-made.

Correct

What kind of recovery facility enables an organization to resume operations as quickly as possible, if not immediately, upon failure of the primary facility?

Hot sites provide backup facilities maintained in constant working order and fully capable of taking over business operations. Warm sites consist of preconfigured hardware and software to run the business, neither of which possesses the vital business information. Cold sites are simply facilities designed with power and environmental support systems but no configured hardware, software, or services. Disaster recovery services can facilitate and implement any of these sites on behalf of a company.

Correct

What form of intellectual property is used to protect words, slogans, and logos?

Trademarks are used to protect the words, slogans, and logos that represent a company and its products or services.

Correct

What type of evidence refers to written documents that are brought into court to prove a fact?

Written documents brought into court to prove the facts of a case are referred to as documentary evidence.

Correct

Why are military and intelligence attacks among the most serious computer crimes?

The purpose of a military and intelligence attack is to acquire classified information. The detrimental effect of using such information could be nearly unlimited in the hands of an enemy. Attacks of this type are launched by very sophisticated attackers. It is often very difficult to ascertain what documents were successfully obtained. So when a breach of this type occurs, you sometimes cannot know the full extent of the damage.

Not Correct

What type of detected incident allows the most time for an investigation?

Scanning incidents are generally reconnaissance attacks. The real damage to a system comes in the subsequent attacks, so you may have some time to react if you detect the scanning attack early.

Not Correct

If you want to restrict access into or out of a facility, which would you choose?

A turnstile is a form of gate that prevents more than one person from gaining entry at a time and often restricts movement to one direction. It is used to gain entry but not exit, or vice versa.

Not Correct

What is the point of a secondary verification system?

Secondary verification mechanisms are set in place to establish a means of verifying the correctness of detection systems and sensors. This often means combining several types of sensors or systems (CCTV, heat and motion sensors, and so on) to provide a more complete picture of detected events.

Correct

Spamming attacks occur when numerous unsolicited messages are sent to a victim. Because enough data is sent to the victim to prevent legitimate activity, it is also known as what?

A spamming attack (sending massive amounts of unsolicited email) can be used as a type of denial-of-service attack. It doesn’t use eavesdropping methods so it isn’t sniffing. Brute-force methods attempt to crack passwords. Buffer overflow attacks send strings of data to a system in an attempt to cause it to fail.

Correct

Which type of intrusion detection system (IDS) can be considered an expert system?

A behavior-based IDS can be labeled an expert system or a pseudo-artificial intelligence system because it can learn and make assumptions about events. In other words, the IDS can act like a human expert by evaluating current events against known events. A knowledge-based IDS uses a database of known attack methods to detect attacks. Both host-based and network-based systems can be either knowledge-based, behavior-based, or a combination of both.