CSSLP practice questions 101–110

1. Question 101 · 171 in bank

   Which of the following processes provides a standard set of activities, general tasks, and a management structure to certify and accredit systems, which maintain the information assurance and the security posture of a system or site?

   • ANSA-IAM
   • BNIACAP
   • CASSET
   • DDITSCAP

   Show answer

   Answer: B

   Explanation

   NIACAP is a process, which provides a standard set of activities, general tasks, and a management structure to certify and accredit systems that process, a set of activities, general task descriptions, and a management structure to certify and accredit the IT systems that will maintain the required security through the use of the questionnaire in NIST.

   Next question

2. Question 102 · 171 in bank

   Which of the following ISO standards provides guidelines for accreditation of an organization that is concerned with certification and registration related to ISMS?

   • AISO 27006
   • BISO 27005
   • CISO 27003
   • DISO 27004

   Show answer

   Answer: A

   Explanation

   ISO 27006 is an information security standard developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). It is entitled as "Information technology - Security techniques - Requirements for bodies providing audit and certification of information security management systems". The ISO 27006 standard provides guidelines for accreditation of an organization which is concerned with certification and registration related to ISMS. The ISO 27006 standard contains the following elements: Scope Normative references Terms and definitions Principles General requirements Structural requirements Resource requirements Information requirements Process requirements Management system requirements for certification bodies Information security risk communication Information security risk monitoring and review Annex A. Defining the scope of process Annex B. Asset valuation and impact assessment Annex C. Examples of typical threats Annex D. Vulnerabilities and vulnerability assessment methods Annex E. Information security risk provides guidelines for information security risk management.

   Next question

3. Question 103 · 171 in bank

   Which of the following security issues does the Bell-La Padula model focus on?

   • AAuthorization
   • BConfidentiality
   • CIntegrity
   • DAuthentication

   Show answer

   Answer: B

   Explanation

   The Bell-La Padula model is a state machine model used for enforcing access control in large organizations. It focuses on data confidentiality and access to classified information, in contrast to the Biba Integrity model, which describes rules for the protection of data integrity. In the Bell-La Padula model, the entities in an information system are divided into subjects and objects. The Bell-La Padula model is built on the concept of a state machine with a set of allowable states in a computer network system. The transition from one state to another state is defined by transition functions. The model defines two mandatory access control (MAC) rules and one discretionary access control (DAC) rule with three security properties: 1.The Simple Security Property: A subject at a given security level may not read an object at a higher security level (no read-up). 2.The *-property (star-property): A subject at a given security level must not write to any object at a lower security level (no write-down). The *-property is also known as the Confinement property. 3.The Discretionary Security Property: It uses an access matrix to specify the discretionary access control.

   Next question

4. Question 104 · 171 in bank

   Which of the following phases of the DITSCAP C&A process is used to define the C&A level of effort, to identify the main C&A roles and responsibilities, and to create an agreement on the method for implementing the security requirements?

   • APhase 1
   • BPhase 4
   • CPhase 2
   • DPhase 3

   Show answer

   Answer: A

   Explanation

   The Phase 1 of the DITSCAP C&A process is known as Definition Phase. The goal of this phase is to define the C&A level of effort, identify the main incorrect. The Phase 4 of the DITSCAP C&A process is known as Post Accreditation.

   Next question

5. Question 105 · 171 in bank

   Which of the following types of obfuscation transformation increases the difficulty for a de-obfuscation tool so that it cannot extract the true application from the obfuscated version?

   • APreventive transformation
   • BData obfuscation
   • CControl obfuscation
   • DLayout obfuscation

   Show answer

   Answer: A

   Explanation

   Preventive transformation increases the difficulty for a de-obfuscation tool so that it cannot extract the true application from the obfuscated version.

   Next question

6. Question 106 · 171 in bank

   Which of the following techniques is used when a system performs the penetration testing with the objective of accessing unauthorized information residing inside a computer?

   • ABiometrician
   • BVan Eck Phreaking
   • CPort scanning
   • DPhreaking

   Show answer

   Answer: C

   Explanation

   Port scanning identifies open doors to a computer. Hackers and crackers use this technique to obtain unauthorized information. Port scanning is the first basic step to get the details of open ports on the target system. Port scanning is used to find a hackable server with a hole or vulnerability. A port is a medium of communication between two computers. Every service on a host is identified by a unique 16-bit number called a port. A port scanner is a piece of software designed to search a network host for open ports. This is often used by administrators to check the security of their networks and by hackers to identify running services on a host with the view to compromising it. Port scanning is used to find the open ports, so that it is possible to search exploits related to distance calls. As telephone networks have become computerized, phreaking has become closely linked with computer hacking. This is sometimes called the H/P equipments are used to pick up the telecommunication signals or data within a computer device.

   Next question

7. Question 107 · 171 in bank

   Which of the following types of attacks is targeting a Web server with multiple compromised computers that are simultaneously sending hundreds of FIN packets with spoofed IP source IP addresses?

   • ADDoS attack
   • BEvasion attack
   • CInsertion attack
   • DDictionary attack

   Show answer

   Answer: A

   Explanation

   A distributed denial of service (DDoS) attack targets a Web server with multiple compromised computers that are simultaneously sending hundreds of FIN packets with spoofed IP source IP addresses. DDoS attack occurs when multiple compromised systems flood the bandwidth or resources of a targeted system, usually one or more Web servers. These systems are compromised by attackers using a variety of methods. It is an attempt to make a computer resource unavailable to its intended users. This type of attack can cause the following to occur: Saturate network resources. Disrupt connections between two computers, guessing attack. This type of attack uses a dictionary of common words to find out the password of a user. It can also use common words in either upper or lower attack, an IDS accepts a packet and assumes that the host computer will also accept it. But in reality, when a host system rejects the packet, the IDS accepts the evasion attack is one in which an IDS rejects a malicious packet but the host computer accepts it. Since an IDS has rejected it, it does not check the contents of the packet. Hence, using this technique, an attacker can exploit the host computer. In many cases, it is quite simple for an attacker to send such data packets that can easily perform evasion attacks on an IDSs.

   Next question

8. Question 108 · 171 in bank

   Select 2

   Which of the following programming languages are compiled into machine code and directly executed by the CPU of a computer system? Each correct answer represents a complete solution. Choose two.

   • AC
   • BMicroosft.NET
   • CJava EE
   • DC++

   Show answer

   Answer: AD

   Explanation

   C and C++ programming languages are unmanaged code. Unmanaged code is compiled into machine code and directly executed by the CPU of a

   Next question

9. Question 109 · 171 in bank

   Which of the following is a standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer system?

   • AFITSAF
   • BFIPS
   • CTCSEC
   • DSSAA

   Show answer

   Answer: C

   Explanation

   Trusted Computer System Evaluation Criteria (TCSEC) is a United States Government Department of Defense (DoD) standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer system. TCSEC was used to evaluate, classify, and select computer systems being considered for the processing, storage, and retrieval of sensitive or classified information. It was replaced with the development of the Common Criteria international standard originally published in 2005. The TCSEC, frequently referred to as the Orange Book, is the centerpiece of the DoD States Department of Defense (DoD) to describe and accredit networks and systems. The SSAA is part of the Department of Defense Information Technology Security Certification and Accreditation Process, or DITSCAP (superseded by DIACAP). The DoD instruction (issues in December 1997, that describes DITSCAP and provides an outline for the SSAA document is DODI 5200.40. The DITSCAP application manual (DoD 8510.1- M), published in July 2000, provides additional of information systems. It provides an approach for federal agencies. It determines how federal agencies are meeting existing policy and establish goals. The main advantage of FITSAF is that it addresses the requirements of Office of Management and Budget (OMB). It also addresses the guidelines provided by the National developed by the United States federal government for use by all non-military government agencies and by government contractors. Many FIPS standards are modified versions of standards used in the wider community (ANSI, IEEE, ISO, etc.). Some FIPS standards were originally developed by the U.S. government. For instance, standards for encoding data (e.g., country codes), but more significantly some encryption standards, such as the Data Encryption Standard (FIPS 46-3) and the Advanced Encryption Standard (FIPS 197). In 1994, NOAA (Noaa) began broadcasting coded signals called FIPS (Federal Information Processing System) codes along with their standard weather broadcasts from local stations. These codes identify the type of emergency and the specific geographic area (such as a county) affected by the emergency.

   Next question

10. Question 110 · 171 in bank

    Which of the following elements of BCP process includes the areas of plan implementation, plan testing, and ongoing plan maintenance, and also involves defining and documenting the continuity strategy?

    • ABusiness continuity plan development
    • BBusiness impact assessment
    • CScope and plan initiation
    • DPlan approval and implementation

    Show answer

    Answer: D

    Explanation

    The business continuity plan development refers to the utilization of the information collected in the Business Impact Analysis (BIA) for the creation of the recovery strategy plan to support the critical business functions. The information gathered from the BIA is mapped out to make a strategy for creating a continuity plan. The business continuity plan development process includes the areas of plan implementation, plan testing, and ongoing plan maintenance. This beginning of the BCP process. It emphasizes on creating the scope and the additional elements required to define the parameters of the plan. The scope and plan initiation phase embodies a check of the company's operations and support services. The scope activities include creating a detailed account of the work required, used to facilitate business units to understand the impact of a disruptive event. This phase includes the execution of a vulnerability assessment. This process makes out the mission-critical areas and business processes that are important for the survival of business. It is similar to the risk assessment process. The function of a business impact assessment process is to create a document, which is used to help and understand what impact a disruptive event would have on senior management signoff, and implementing a maintenance procedure for updating the plan as required.

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CSSLP practice, question 101. 171 questions available.