Question 111 · 203 in bank
Which of the following is less likely to be included in the change control sub-phase of the maintenance phase of a software product?
Show answer
Answer: A
ISC2 Systems Security Certified Practitioner203 questions across 21 pages are complete and free, with no account or card.
203 questions in this bank
Free access · progress saved on this device
Which of the following is less likely to be included in the change control sub-phase of the maintenance phase of a software product?
Answer: A
Which of the following rules is least likely to support the concept of least privilege?
Answer: B
Only data to and from critical systems and applications should be allowed through the firewall is a detractor. Critical systems or applications do not necessarily need to have traffic go through a firewall. Even if they did, only the minimum required services should be allowed. Systems that are not deemed critical may also need to have traffic go through the firewall. Least privilege is a basic tenet of computer security that means users should be given only those rights required to do their jobs or tasks. Least privilege is ensuring that you have the minimum privileges necessary to do a task. An admin NOT using his admin account to check email is a clear example of this. Reference(s) used for this question: National Security Agency, Systems and Network Attack Center (SNAC), The 60 Minute Network Security Guide, February 2002, page 9.
Source: Adapted from community discussion — Narobi
Which of the following best defines add-on security?
Answer: A
A. Physical security complementing logical security measures. Add-on security typically refers to physical security measures that complement or supplement logical security measures in an information system. While both physical and logical security are essential for overall security, add-on security specifically focuses on additional physical safeguards, such as biometric access controls, surveillance cameras, locked server rooms, and secure hardware tokens, to enhance the security of an information system. These physical measures are added to strengthen the overall security posture of the system beyond the purely logical or software-based security measures.
Source: Adapted from community discussion — Stevovo123
In biometrics, "one-to-many" search against database of stored biometric images is done in:
Answer: B
One purpose of a security awareness program is to modify:
Answer: A
Security-awareness training is performed to modify employees behavior and attitude toward security. This can best be achieved through a formalized process of security-awareness training. It is used to increase the overall awareness of security throughout the company. It is targeted to every single employee and not only to one group of users. Unfortunately you cannot apply a patch to a human being, the only thing you can do is to educate employees and make them more aware of security issues and threats. Never underestimate human stupidity. Reference(s) used for this question: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation. also see: Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 130). McGraw-Hill. Kindle Edition.
In biometrics, the "one-to-one" search used to verify claim to an identity made by a person is considered:
Answer: A
Whose role is it to assign classification level to information?
Answer: C
The Data/Information Owner is ultimately responsible for the protection of the data. It is the Data/Information Owner that decides upon the classifications of that data they are responsible for. The data owner decides upon the classification of the data he is responsible for and alters that classification if the business need arises. The following answers are incorrect: Security Administrator. Is incorrect because this individual is responsible for ensuring that the access right granted are correct and support the polices and directives that the Data/Information Owner defines. User. Is Incorrect because the user uses/access the data according to how the Data/Information Owner defined their access. Auditor. Is incorrect because the Auditor is responsible for ensuring that the access levels are appropriate. The Auditor would verify that the Owner classified the data properly. References: CISSP All In One Third Edition, Shon Harris, Page 121
In what way could Java applets pose a security threat?
Answer: D
Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.
Source: Adapted from community discussion — formazionehs
A security evaluation report and an accreditation statement are produced in which of the following phases of the system development life cycle?
Answer: D
which describes the level the system is allowed to operate at. Because those two activities are a part of testing and testing is a part of the acceptance phase, the only answer above that can be correct is "acceptance phase". The other answers are not correct because: The "project initiation and planning phase" is just the idea phase. Nothing has been developed yet to be evaluated, tested, accredited, etc. The "system design specification phase" is essentially where the initiation and planning phase is fleshed out. For example, in the initiation and planning phase, we might decide we want the system to have authentication. In the design specification phase, we decide that that authentication will be accomplished via username/ password. But there is still nothing actually developed at this point to evaluate or accredit. The "development & documentation phase" is where the system is created and documented. Part of the documentation includes specific evaluation and accreditation criteria. That is the criteria that will be used to evaluate and accredit the system during the "acceptance phase". In other words - you cannot evaluate or accredit a system that has not been created yet. Of the four answers listed, only the acceptance phase is dealing with an existing system. The others deal with planning and creating the system, but the actual system isn't there yet. Reference: Official ISC2 Guide Page: 558 - 559 All in One Third Edition page: 832 - 833 (recommended reading)
The information security staff's participation in which of the following system development life cycle phases provides maximum benefit to the organization?
Answer: D
Information security should ideally be integrated into every phase of the system development life cycle (SDLC) to provide maximum benefit to the organization. This approach, often referred to as "security by design," ensures that security considerations are addressed from the very beginning of the project and throughout its entire lifecycle. Waiting until a specific phase to address security can lead to vulnerabilities and weaknesses being introduced and not caught until later stages, which can be more costly and challenging to fix.
Source: Adapted from community discussion — Stevovo123
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SSCP practice, question 111. 203 questions available.
Version 1.0.0. How we source questions