CSSLP practice questions 21–30

1. Question 21 · 171 in bank

   Which of the following DITSCAP C&A phases takes place between the signing of the initial version of the SSAA and the formal accreditation of the system?

   • APhase 4
   • BPhase 3
   • CPhase 1
   • DPhase 2

   Show answer

   Answer: D

   Explanation

   The Phase 2 of DITSCAP C&A is known as Verification. The goal of this phase is to obtain a fully integrated system for certification testing and accreditation. This phase takes place between the signing of the initial version of the SSAA and the formal accreditation of the system. This phase verifies security SSAA and the formal accreditation of the system.

   Next question

2. Question 22 · 171 in bank

   DRAG DROP - Drop the appropriate value to complete the formula. Select and Place:

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   A Single Loss Expectancy (SLE) is the value in dollar ($) that is assigned to a single event. The SLE can be calculated by the following formula: SLE = Asset Value ($) X Exposure Factor (EF) The Exposure Factor (EF) represents the % of assets loss caused by a threat. The EF is required to calculate the Single Loss Expectancy (SLE). The Annualized Loss Expectancy (ALE) can be calculated by multiplying the Single Loss Expectancy (SLE) with the Annualized Rate of Occurrence (ARO). Annualized Loss Expectancy (ALE) = Single Loss Expectancy (SLE) X Annualized Rate of Occurrence (ARO) Annualized Rate of Occurrence (ARO) is a number that represents the estimated frequency in which a threat is expected to occur. It is calculated based upon the probability of the event occurring and the number of employees that could make that event occur.

   

   Next question

3. Question 23 · 171 in bank

   In which of the following testing methodologies do assessors use all available documentation and work under no constraints, and attempt to circumvent the security features of an information system?

   • AFull operational test
   • BPenetration test
   • CPaper test
   • DWalk-through test

   Show answer

   Answer: B

   Next question

4. Question 24 · 171 in bank

   You work as a systems engineer for BlueWell Inc. Which of the following tools will you use to look outside your own organization to examine how others achieve their performance levels, and what processes they use to reach those levels?

   • ABenchmarking
   • BSix Sigma
   • CISO 9001:2000
   • DSEI-CMM

   Show answer

   Answer: A

   Explanation

   Correct Answer: A Explanation/Reference: Explanation: Benchmarking is the tool used by system assessment process to provide a point of reference by which performance measurements can be reviewed with respect to other organizations. Benchmarking is also recognized as Best Practice Benchmarking or Process Benchmarking. It is a process used in management and mostly useful for strategic management.

   Source: Adapted from community discussion — anuradha1306

   Next question

5. Question 25 · 171 in bank

   Which of the following methods determines the principle name of the current user and returns the jav a.security.Principal object in the HttpServletRequest interface?

   • AgetUserPrincipal()
   • BisUserInRole()
   • CgetRemoteUser()
   • DgetCallerPrincipal()

   Show answer

   Answer: A

   Explanation

   The getUserPrincipal() method determines the principle name of the current user and returns the java.security.Principal object. The incorrect. The getRemoteUser() method returns the user name that is used for the client authentication. The value of the getRemoteUser() method returns null if method is used to identify a caller using a java.security.Principal object. It is not used in the HttpServletRequest interface.

   References

   • Oracle documentation

   Next question

6. Question 26 · 171 in bank

   Select 5

   The NIST Information Security and Privacy Advisory Board (ISPAB) paper "Perspectives on Cloud Computing and Standards" specifies potential advantages and disdvantages of virtualization. Which of the following disadvantages does it include? Each correct answer represents a complete solution. Choose all that apply.

   • AIt increases capabilities for fault tolerant computing using rollback and snapshot features.
   • BIt increases intrusion detection through introspection.
   • CIt initiates the risk that malicious software is targeting the VM environment.
   • DIt increases overall security risk shared resources.
   • EIt creates the possibility that remote attestation may not work.
   • FIt involves new protection mechanisms for preventing VM escape, VM detection, and VM-VM interference.
   • GIt increases configuration effort because of complexity and composite system.

   Show answer

   Answer: CDEFG

   Explanation

   The potential security disadvantages of virtualization are as follows: It increases configuration effort because of complexity and composite system. It initiates the problem of how to prevent overlap while mapping VM storage onto host files. It introduces the problem of virtualizing the TPM. It creates the possibility that remote attestation may not work. It initiates the problem of detecting VM covert channels. It involves new protection mechanisms for preventing VM escape, VM detection, and VM-VM interference. It initiates the possibility of virtual networking configuration errors. It initiates the risk that malicious software is targeting the VM environment. incorrect. These are not the disadvantages of virtualization, as described in the NIST Information Security and Privacy Advisory Board (ISPAB) paper "Perspectives on Cloud Computing and Standards".

   Next question

7. Question 27 · 171 in bank

   Select 3

   Which of the following are the types of access controls? Each correct answer represents a complete solution. Choose three.

   • APhysical
   • BTechnical
   • CAdministrative
   • DAutomatic

   Show answer

   Answer: ABC

   Explanation

   Security guards, locks on the gates, and alarms come under physical access control. Policies and procedures implemented by an organization come incorrect. There is no such type of access control as automatic control.

   Next question

8. Question 28 · 171 in bank

   Select 4

   What are the subordinate tasks of the Initiate and Plan IA C&A phase of the DIACAP process? Each correct answer represents a complete solution. Choose all that apply.

   • AInitiate IA implementation plan
   • BDevelop DIACAP strategy
   • CAssign IA controls.
   • DAssemble DIACAP team
   • ERegister system with DoD Component IA Program.
   • FConduct validation activity.

   Show answer

   Answer: ABDE

   Explanation

   The Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) is a process defined by the United States Department of Defense (DoD) for managing risk. The subordinate tasks of the Initiate and Plan IA C&A phase are as follows: Register system with DoD Component IA Program. Assign IA controls. Assemble DIACAP process, i.e., Implement and Validate Assigned IA Controls.

   Next question

9. Question 29 · 171 in bank

   Which of the following attacks causes software to fail and prevents the intended users from accessing software?

   • AEnabling attack
   • BReconnaissance attack
   • CSabotage attack
   • DDisclosure attack

   Show answer

   Answer: C

   Explanation

   A sabotage attack is an attack that causes software to fail. It also prevents the intended users from accessing software. A sabotage attack is referred attack delivers an easy path for other attacks.

   Next question

10. Question 30 · 171 in bank

    FITSAF stands for Federal Information Technology Security Assessment Framework. It is a methodology for assessing the security of information systems. Which of the following FITSAF levels shows that the procedures and controls have been implemented?

    • ALevel 2
    • BLevel 3
    • CLevel 5
    • DLevel 1
    • ELevel 4

    Show answer

    Answer: B

    Explanation

    https://csrc.nist.gov/files/pubs/other/2000/11/28/federal-information-technology-security-assessment/final/docs/federal-it-saf-2000.pdf Level 1 Documented Policy Level 2 Documented Procedures Level 3 Implemented Procedures and Controls Level 4 Tested and Reviewed Procedures and Controls Level 5 Fully Integrated Procedures and Controls The correct answer is B. Level 3, which indicates that the procedures and controls have been implemented and their effectiveness is being tested or validated.

    Source: Adapted from community discussion — 74gjd_37

    References

    • nist.gov documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CSSLP practice, question 21. 171 questions available.