Question 121 · 203 in bank
Which of the following is the act of performing tests and evaluations to test a system's security level to see if it complies with the design specifications and security requirements?
Show answer
Answer: C
ISC2 Systems Security Certified Practitioner203 questions across 21 pages are complete and free, with no account or card.
203 questions in this bank
Free access · progress saved on this device
Which of the following is the act of performing tests and evaluations to test a system's security level to see if it complies with the design specifications and security requirements?
Answer: C
Which of the following is NOT true concerning Application Control?
Answer: D
Source: TIPTON, Harold F. & KRAUSE, MICKI, Information Security Management Handbook, 4th Edition, Volume 2, Auerbach.
Which of the following are NOT a countermeasure to traffic analysis?
Answer: B
Eavesdropping is not a countermeasure, it is a type of attack where you are collecting traffic and attempting to see what is being send between entities communicating with each other. The following answers are incorrect: Padding Messages. Is incorrect because it is considered a countermeasure you make messages uniform size, padding can be used to counter this kind of attack, in which decoy traffic is sent out over the network to disguise patterns and make it more difficult to uncover patterns. Sending Noise. Is incorrect because it is considered a countermeasure, tansmitting non-informational data elements to disguise real data. Faraday Cage Is incorrect because it is a tool used to prevent emanation of electromagnetic waves. It is a very effective tool to prevent traffic analysis.
Which of the following is not one of the three goals of Integrity addressed by the Clark-Wilson model?
Answer: D
D A Security Model for Integrity Integrity models are used to describe what needs to be done to enforce the information integrity policies. There are three goals of integrity: (Summers, p.142) · Prevent unauthorized modifications · Maintain internal and external consistency · Prevent authorized but improper modifications Page 4 - https://www.giac.org/paper/gsec/835/clark-wilson-security-model/101747#:~:text=The%20Clark%2DWilson%20(CW)%20model%20is%20an%20integrity%2C,in%201989%20by%20David%20D.
Source: Adapted from community discussion — SteroidalRED
External consistency ensures that the data stored in the database is:
Answer: D
External consistency ensures that the data stored in the database is consistent with the real world. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, page 33.
Source: Adapted from community discussion — formazionehs
Which of the following is the MOST important aspect relating to employee termination?
Answer: C
Each aspect mentioned is critical during an employee termination process, but when considering the most important aspect, especially in terms of security and data protection, **C. User ID and passwords of the employee have been deleted** tends to take precedence. Revoking access to systems, accounts, and company resources by deleting or deactivating user IDs and passwords is crucial to prevent unauthorized access to sensitive information or systems after an employee leaves. This action helps safeguard against potential security breaches and unauthorized use of company resources, which can have significant implications for data security and integrity.
Source: Adapted from community discussion — nanson
Which of the following is a CHARACTERISTIC of a decision support system (DSS) in regards to Threats and Risks Analysis?
Answer: D
DSS emphasizes flexibility in the decision-making approach of users. It is aimed at solving less structured problems, combines the use of models and analytic techniques with traditional data access and retrieval functions and supports semi-structured decision-making tasks. DSS is sometimes referred to as the Delphi Method or Delphi Technique: The Delphi technique is a group decision method used to ensure that each member gives an honest opinion of what he or she thinks the result of a particular threat will be. This avoids a group of individuals feeling pressured to go along with others thought processes and enables them to participate in an independent and anonymous way. Each member of the group provides his or her opinion of a certain threat and turns it in to the team that is performing the analysis. The results are compiled and distributed to the group members, who then write down their comments anonymously and return them to the analysis group. The comments are compiled and redistributed for more comments until a consensus is formed. This method is used to obtain an agreement on cost, loss values, and probabilities of occurrence without individuals having to agree verbally. Here is the ISC2 book coverage of the subject: One of the methods that uses consensus relative to valuation of information is the consensus/modified Delphi method. Participants in the valuation exercise are asked to comment anonymously on the task being discussed. This information is collected and disseminated to a participant other than the original author. This participant comments upon the observations of the original author. The information gathered is discussed in a public forum and the best course is agreed upon by the group (consensus). EXAM TIP: The DSS is what some of the books are referring to as the Delphi Method or Delphi Technique. Be familiar with both terms for the purpose of the exam. The other answers are incorrect: 'DSS is aimed at solving highly structured problems' is incorrect because it is aimed at solving less structured problems. 'DSS supports only structured decision-making tasks' is also incorrect as it supports semi-structured decision-making tasks. 'DSS combines the use of models with non-traditional data access and retrieval functions' is also incorrect as it combines the use of models and analytic techniques with traditional data access and retrieval functions. Reference(s) used for this question: Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (p. 91). McGraw-Hill. Kindle Edition. and Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition : Information Security Governance and Risk Management ((ISC)2 Press) (Kindle Locations 1424-1426). Auerbach Publications. Kindle Edition.
Source: Adapted from community discussion — nanson
What would BEST define a covert channel?
Answer: C
The best definition of a covert channel is: C. A communication channel that allows the transfer of information in a manner that violates the system's security policy. Covert channels are methods or paths within a system that allow information to be transferred in a way that circumvents or violates the system's intended security policies or restrictions. These channels are typically used to bypass normal security controls, enabling unauthorized communication or information transfer.
Source: Adapted from community discussion — nanson
A common way to create fault tolerance with leased lines is to group several T1s together with an inverse multiplexer placed:
Answer: B
Which of the following is responsible for MOST of the security issues?
Answer: C
Personnel cause more security issues than hacker attacks, outside espionage, or equipment failure. The following answers are incorrect because: Outside espionage is incorrect as it is not the best answer. Hackers is also incorrect as it is not the best answer. Equipment failure is also incorrect as it is not the best answer. Reference : Shon Harris AIO v3 , Chapter-3: Security Management Practices , Page : 56
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SSCP practice, question 121. 203 questions available.
Version 1.0.0. How we source questions