CSSLP practice questions 141–150

1. Question 141 · 171 in bank

   Select 3

   Which of the following are the principle duties performed by the BIOS during POST (power-on-self-test)? Each correct answer represents a part of the solution. Choose all that apply.

   • AIt provides a user interface for system's configuration.
   • BIt identifies, organizes, and selects boot devices.
   • CIt delegates control to other BIOS, if it is required.
   • DIt discovers size and verifies system memory.
   • EIt verifies the integrity of the BIOS code itself.
   • FIt interrupts the execution of all running programs.

   Show answer

   Answer: BDE

   Explanation

   The principle duties performed by the BIOS during POST (power-on-self-test) are as follows: It verifies the integrity of the BIOS code itself. It discovers size and verifies system memory. It discovers, initializes, and catalogs all system hardware. It delegates control to other BIOS if it is required. It provides does not interrupt the execution of all running programs.

   Next question

2. Question 142 · 171 in bank

   In which of the following architecture styles does a device receive input from connectors and generate transformed outputs?

   • AN-tiered
   • BHeterogeneous
   • CPipes and filters
   • DLayered

   Show answer

   Answer: C

   Explanation

   In the pipes and filters architecture style, a device receives input from connectors and generates transformed outputs. A pipeline has a series of processing elements in which the output of each element works as an input of the next element. A little amount of buffering is provided between the two successive elements.

   Next question

3. Question 143 · 171 in bank

   Fred is the project manager of the CPS project. He is working with his project team to prioritize the identified risks within the CPS project. He and the team are prioritizing risks for further analysis or action by assessing and combining the risks probability of occurrence and impact. What process is Fred completing?

   • ARisk identification
   • BRisk Breakdown Structure creation
   • CPerform qualitative analysis
   • DPerform quantitative analysis

   Show answer

   Answer: C

   Explanation

   Qualitative ranks the probability and impact and then helps the project manager and team to determine which risks need further analysis. Perform Qualitative Risk Analysis is the process of prioritizing risks for further analysis and action. It combines risks and their probability of occurrences and ranks them accordingly. It enables organizations to improve the project's performance by focusing on high-priority risks. Perform Qualitative Risk Analysis is usually a rapid complete in a risk breakdown structure. analysis.

   Next question

4. Question 144 · 171 in bank

   Select 5

   Which of the following are the levels of public or commercial data classification system? Each correct answer represents a complete solution. Choose all that apply.

   • ASensitive
   • BPrivate
   • CUnclassified
   • DConfidential
   • ESecret
   • FPublic

   Show answer

   Answer: ABDEF

   Explanation

   The public or commercial data classification is also built upon a four-level model, which are as follows: Public Sensitive Private Confidential Each level (top to bottom) represents an increasing level of sensitivity. The public level is similar to unclassified level military classification system. This level of data should not cause any damage if disclosed. Sensitive is a higher level of classification than public level data. This level of data requires a greater level of protection to maintain confidentiality. The Private level of data is intended for company use only. Disclosure of this level of data can damage the company. The Confidential C and E are incorrect. Unclassified and secret are the levels of military data classification.

   Next question

5. Question 145 · 171 in bank

   Select 3

   Continuous Monitoring is the fourth phase of the security certification and accreditation process. What activities are performed in the Continuous Monitoring process? Each correct answer represents a complete solution. Choose all that apply.

   • ASecurity accreditation decision
   • BSecurity control monitoring and impact analyses of changes to the information system
   • CSecurity accreditation documentation
   • DConfiguration management and control
   • EStatus reporting and documentation

   Show answer

   Answer: BDE

   Explanation

   Continuous Monitoring is the fourth phase of the security certification and accreditation process. The Continuous Monitoring process consists of the following three main activities: Configuration management and control Security control monitoring and impact analyses of changes to the information system Status reporting and documentation The objective of these tasks is to observe and evaluate the information system security controls during the system life cycle. decision and security accreditation documentation are the two tasks of the security accreditation phase.

   Next question

6. Question 146 · 171 in bank

   Select 2

   Which of the following statements are true about declarative security? Each correct answer represents a complete solution. Choose all that apply.

   • AIt is employed in a layer that relies outside of the software code or uses attributes of the code.
   • BIt applies the security policies on the software applications at their runtime.
   • CIn this security, authentication decisions are made based on the business logic.
   • DIn this security, the security decisions are based on explicit statements.

   Show answer

   Answer: AB

   Explanation

   Declarative security applies the security policies on the software applications at their runtime. In this type of security, the security decisions are based on explicit statements that confine security behavior. Declarative security applies security permissions that are required for the software application to access the local resources and provides role-based access control to an individual software component and software application. It is employed in a layer that relies outside operational or external security perspective.

   Next question

7. Question 147 · 171 in bank

   What project management plan is most likely to direct the quantitative risk analysis process for a project in a matrix environment?

   • ARisk analysis plan
   • BStaffing management plan
   • CRisk management plan
   • DHuman resource management plan

   Show answer

   Answer: C

   Explanation

   The risk management plan defines how risks will be identified, analyzed, responded to, and then monitored and controlled regardless of the structure

   Next question

8. Question 148 · 171 in bank

   Select 3

   The DoD 8500 policy series represents the Department's information assurance strategy. Which of the following objectives are defined by the DoD 8500 series? Each correct answer represents a complete solution. Choose all that apply.

   • ADefending systems
   • BProviding IA Certification and Accreditation
   • CProviding command and control and situational awareness
   • DProtecting information

   Show answer

   Answer: ACD

   Explanation

   The various objectives of the DoD 8500 series are as follows: Protecting information Defending systems Providing command and control and situational awareness Making sure that the information assurance is integrated into processes Increasing security awareness throughout the DoD's workforce

   Next question

9. Question 149 · 171 in bank

   Which of the following vulnerabilities occurs when an application directly uses or concatenates potentially hostile input with data file or stream functions?

   • AInsecure cryptographic storage
   • BMalicious file execution
   • CInsecure communication
   • DInjection flaw

   Show answer

   Answer: D

   Explanation

   Malicious file execution is a vulnerability that occurs when an application directly uses or concatenates potentially hostile input with data file or stream functions. This leads to arbitrary remote and hostile data being included, processed, and invoked by the Web server. Malicious file execution can be prevented by is incorrect. Insecure communication occurs when applications have failed to encrypt network traffic.

   Next question

10. Question 150 · 171 in bank

    Select 3

    Which of the following are the primary functions of configuration management? Each correct answer represents a complete solution. Choose all that apply.

    • AIt removes the risk event entirely by adding additional steps to avoid the event.
    • BIt ensures that the change is implemented in a sequential manner through formalized testing.
    • CIt reduces the negative impact that the change might have had on the computing services and resources.
    • DIt analyzes the effect of the change that is implemented on the system.

    Show answer

    Answer: BCD

    Explanation

    The primary functions of configuration management are as follows: It ensures that the change is implemented in a sequential manner through formalized testing. It ensures that the user base is informed of the future change. It analyzes the effect of the change that is implemented on the system. It reduces configuration management. It is the function of risk avoidance.

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CSSLP practice, question 141. 171 questions available.