CSSLP practice questions 51–60

1. Question 51 · 171 in bank

   You work as a project manager for BlueWell Inc. You with your team are using a method or a (technical) process that conceives the risks even if all theoretically possible safety measures would be applied. One of your team member wants to know that what is a residual risk. What will you reply to your team member?

   • AIt is a risk that remains because no risk response is taken.
   • BIt is a risk that can not be addressed by a risk response.
   • CIt is a risk that will remain no matter what type of risk response is offered.
   • DIt is a risk that remains after planned risk responses are taken.

   Show answer

   Answer: D

   Explanation

   Residual risks are generally smaller risks that remain in the project after larger risks have been addressed. The residual risk is the risk or danger of an action or an event, a method or a (technical) process that still conceives these dangers even if all theoretically possible safety measures would be applied. The risks.

   Next question

2. Question 52 · 171 in bank

   DoD 8500.2 establishes IA controls for information systems according to the Mission Assurance Categories (MAC) and confidentiality levels. Which of the following MAC levels requires high integrity and medium availability?

   • AMAC III
   • BMAC IV
   • CMAC I
   • DMAC II

   Show answer

   Answer: D

   Explanation

   The various MAC levels are as follows: MAC I: It states that the systems have high availability and high integrity. MAC II: It states that the systems have high integrity and medium availability. MAC III: It states that the systems have basic integrity and availability.

   Source: Adapted from community discussion — 74gjd_37

   Next question

3. Question 53 · 171 in bank

   You are the project manager of the NNN project for your company. You and the project team are working together to plan the risk responses for the project. You feel that the team has successfully completed the risk response planning and now you must initiate what risk process it is. Which of the following risk processes is repeated after the plan risk responses to determine if the overall project risk has been satisfactorily decreased?

   • AQuantitative risk analysis
   • BRisk identification
   • CRisk response implementation
   • DQualitative risk analysis

   Show answer

   Answer: A

   Explanation

   The quantitative risk analysis process is repeated after the plan risk responses to determine if the overall project risk has been satisfactorily

   Next question

4. Question 54 · 171 in bank

   Which of the following statements is true about residual risks?

   • AIt is the probabilistic risk after implementing all security measures.
   • BIt can be considered as an indicator of threats coupled with vulnerability.
   • CIt is a weakness or lack of safeguard that can be exploited by a threat.
   • DIt is the probabilistic risk before implementing all security measures.

   Show answer

   Answer: A

   Explanation

   The residual risk is the risk or danger of an action or an event, a method or a (technical) process that still conceives these dangers even if all theoretically possible safety measures would be applied. The formula to calculate residual risk is (inherent risk) x (control risk) where inherent risk is (threats security risk is a probabilistic function of a given threat agent exercising a particular vulnerability and the impact of that risk on the organization. Security risks can be exploited by a threat, thus causing harm to the information systems or networks. It can exist in hardware , operating systems, firmware, applications, and configuration files. Vulnerability has been variously defined in the current context as follows: 1.A security weakness in a Target of Evaluation due to failures in analysis, design, implementation, or operation and such. 2.Weakness in an information system or components (e.g. system security procedures, hardware design, or internal controls that could be exploited to produce an information-related misfortune.) 3.The existence of a weakness, design, or implementation error that can lead to an unexpected, undesirable event compromising the security of the system, network, application, or protocol involved.

   Next question

5. Question 55 · 171 in bank

   To help review or design security controls, they can be classified by several criteria . One of these criteria is based on their nature. According to this criterion, which of the following controls consists of incident response processes, management oversight, security awareness, and training?

   • ACompliance control
   • BPhysical control
   • CProcedural control
   • DTechnical control

   Show answer

   Answer: C

   Next question

6. Question 56 · 171 in bank

   A Web-based credit card company had collected financial and personal details of Mark before issuing him a credit card. The company has now provided Mark's financial and personal details to another company. Which of the following Internet laws has the credit card issuing company violated?

   • ATrademark law
   • BSecurity law
   • CPrivacy law
   • DCopyright law

   Show answer

   Answer: C

   Explanation

   The credit card issuing company has violated the Privacy law. According to the Internet Privacy law, a company cannot provide their customer's dramatic, musical, artistic, and certain other intellectual works.

   Next question

7. Question 57 · 171 in bank

   There are seven risks responses that a project manager can choose from. Which risk response is appropriate for both positive and negative risk events?

   • AAcceptance
   • BTransference
   • CSharing
   • DMitigation

   Show answer

   Answer: A

   Next question

8. Question 58 · 171 in bank

   You work as a Security Manager for Tech Perfect Inc. In the organization, Syslog is used for computer system management and security auditing, as well as for generalized informational, analysis, and debugging messages. You want to prevent a denial of service (DoS) for the Syslog server and the loss of Syslog messages from other sources. What will you do to accomplish the task?

   • AUse a different message format other than Syslog in order to accept data.
   • BEnable the storage of log entries in both traditional Syslog files and a database.
   • CLimit the number of Syslog messages or TCP connections from a specific source for a certain time period.
   • DEncrypt rotated log files automatically using third-party or OS mechanisms.

   Show answer

   Answer: C

   Next question

9. Question 59 · 171 in bank

   You work as a project manager for a company. The company has started a new security software project. The software configuration management will be used throughout the lifecycle of the project. You are tasked to modify the functional features and the basic logic of the software and then make them compatible to the initial design of the project. Which of the following procedures of the configuration management will you follow to accomplish the task?

   • AConfiguration status accounting
   • BConfiguration control
   • CConfiguration audits
   • DConfiguration identification

   Show answer

   Answer: B

   Explanation

   Configuration control is a procedure of the Configuration management. Configuration control is a set of processes and approval stages required to change a configuration item's attributes and to re-baseline them. It supports the change of the functional and physical attributes of software at various points in identification for a configured item is accurate, complete, and will meet specified program needs. Configuration audits are broken into functional and physical configuration audits. They occur either at delivery or at the moment of effecting the change. A functional configuration audit ensures that functional and performance attributes of a configuration item are achieved, while a physical configuration audit ensures that a configuration item is installed in accordance with every aspect of a configuration item. A configuration item is a product (hardware and/or software) that has an end-user purpose. These attributes are recorded in configuration documentation and baselined. Baselining an attribute forces formal configuration change control processes to be effected in the event that these associated with each configuration item at any moment of time. It supports the functional and physical attributes of software at various points in time, and performs systematic control of accounting to the identified attributes for the purpose of maintaining software integrity and traceability throughout the software development life cycle.

   Next question

10. Question 60 · 171 in bank

    Which of the following areas of information system, as separated by Information Assurance Framework, is a collection of local computing devices, regardless of physical location, that are interconnected via local area networks (LANs) and governed by a single security policy?

    • ALocal Computing Environments
    • BNetworks and Infrastructures
    • CSupporting Infrastructures
    • DEnclave Boundaries

    Show answer

    Answer: A

    Explanation

    The areas of information system, as separated by Information Assurance Framework, are as follows: Local Computing Environments: This area includes servers, client workstations, operating system, and applications. Enclave Boundaries: This area consists of collection of local computing devices, regardless of physical location, that are interconnected via local area networks (LANs) and governed by a single security policy. Networks and Infrastructures: This area provides the network connectivity between enclaves. It includes operational area networks (OANs), metropolitan area networks (MANs), and campus area networks (CANs). Supporting Infrastructures: This area provides security services for networks, client workstations, Web servers, operating systems, applications, files, and single-use infrastructure machines

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CSSLP practice, question 51. 171 questions available.