[2022] Practice with these CISSP dumps Certification Sample Questions
Get Instant Access of 100% REAL CISSP DUMP Pass Your Exam Easily
NEW QUESTION 529
An advantage of link encryption in a communications network is that it
- A. encrypts all information, including headers and routing information.
- B. protects data from start to finish through the entire network.
- C. makes key management and distribution easier.
- D. improves the efficiency of the transmission.
Answer: A
NEW QUESTION 530
In a database management system (DBMS), what is the "cardinality?"
- A. The set of allowable values that an attribute can take.
- B. The number of rows in a relation.
- C. The number of columns in a relation.
- D. The number of relations in a database.
Answer: B
Explanation:
Cardinality is the "number" of rows in a relation. The rows of the table represent records or tuples.
Degree is the "number" of columns in a relation. The individual columns of the table represent the attributes.
A relation is the basis of a relational database and is represented by a two-dimensional table.
The domain of a relation is the set of allowable values that an attribute can take.
Sources:
WALLHOFF, John, CISSP Summary 2002, April 2002, CBK#4 Applications & Systems
Development Security (page 1), /Documents/CISSP_Summary_2002/index.html.
KRUTZ, Ronald & VINES, Russel, The CISSP Prep Guide: Gold Edition, Wiley Publishing
Inc., 2003, Chapter 2: Relational Database Security (page 59).
NEW QUESTION 531
The main objective of the Java Security Model ( JSM) is to:
- A. Provide accountability for events
- B. Protect the local client from user-input hostile code
- C. Protect the user from hostile, network mobile code
- D. Protect a web server from hostile, client code
Answer: C
Explanation:
When a user accesses a Web page through a browser, class files for
an applet are downloaded automatically, even from untrusted
sources. To counter this possible threat, Java provides a
customizable sandbox to which the applets' execution is confined.
This sandbox provides such protections as preventing reading and
writing to a local disk, prohibiting the creation of a new process,
prevention of making a network connection to a new host and
preventing the loading of a new dynamic library and directly calling
a native method. The sandbox security features are designed into the
Java Virtual Machine (JVM). These features are implemented through
array bounds checking, structured memory access, type-safe
reference cast checking to ensure that casting to an object of a
different type is valid, and checking for null references and
automatic garbage collection. These checks are designed to limit
memory accesses to safe, structured operations.
The other answers are distracters.
NEW QUESTION 532
A security professional has just completed their organization's Business Impact Analysis (BIA). Following Business Continuity Plan/Disaster Recovery Plan (BCP/DRP) best practices, what would be the professional's NEXT step?
- A. Identify and select recovery strategies.
- B. Present the findings to management for funding.
- C. Prepare a plan to test the organization's ability to recover its operations.
- D. Select members for the organization's recovery teams.
Answer: A
NEW QUESTION 533
Which of the following actions will reduce risk to a laptop before traveling to a high risk area?
- A. Examine the device for physical tampering
- B. Change access codes
- C. Implement more stringent baseline configurations
- D. Purge or re-image the hard disk drive
Answer: B
Explanation:
Section: Security and Risk Management
NEW QUESTION 534
What is called the formal acceptance of the adequacy of a system's overall security by the management?
- A. Acceptance
- B. Evaluation
- C. Certification
- D. Accreditation
Answer: D
Explanation:
Accreditation is the authorization by management to implement software or systems in a production environment. This authorization may be either provisional or full.
The following are incorrect answers:
Certification is incorrect. Certification is the process of evaluating the security stance of the
software or system against a selected set of standards or policies. Certification is the technical
evaluation of a product. This may precede accreditation but is not a required precursor.
Acceptance is incorrect. This term is sometimes used as the recognition that a piece of software or
system has met a set of functional or service level criteria (the new payroll system has passed its
acceptance test). Certification is the better tem in this context.
Evaluation is incorrect. Evaluation is certainly a part of the certification process but it is not the
best answer to the question.
Reference(s) used for this question:
The Official Study Guide to the CBK from ISC2, pages 559-560
AIO3, pp. 314 - 317
AIOv4 Security Architecture and Design (pages 369 - 372)
AIOv5 Security Architecture and Design (pages 370 - 372)
NEW QUESTION 535
Which of the following can be defined as THE unique attribute used as a unique identifier within a given table to identify a tuple?
- A. candidate key
- B. secondary key
- C. foreign key
- D. primary key
Answer: D
Explanation:
Explanation/Reference:
Explanation:
The primary key is the attribute that is used to make each row or tuple in a table unique.
Incorrect Answers:
B: Candidate keys are a subset of attributes that from which the database developer can choose the primary key to uniquely identify any tuple or record in a table.
C: A foreign key is an attribute in one table that matches the primary key of another table and is used to cross-reference tables.
D: Secondary keys are candidate keys that have not been chosen as the primary key. The primary key is the attribute that is used to make each row or tuple in a table unique. Candidate keys are a subset of attributes that from which the database developer can choose the primary key.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 1174, 1179-
1180
Stewart, James, Ed Tittel and Mike Chapple, CISSP: Certified Information Systems security Professional Study Guide, 5th Edition, Wiley Publishing, Indianapolis, 2011, pp. 276, 312
http://databases.about.com/cs/specificproducts/g/candidate.htm
http://rdbms.opengrass.net/2_Database Design/2.1_TermsOfReference/2.1.2_Keys.html
NEW QUESTION 536
Which of the following is considered best practice for preventing e-mail spoofing?
- A. Cryptographic signature
- B. Reverse Domain Name Service (DNS) lookup
- C. Uniform Resource Locator (URL) filtering
- D. Spam filtering
Answer: A
Explanation:
Section: Communication and Network Security
NEW QUESTION 537
This type of backup management provides a continuous on-line backup by using optical or tape "jukeboxes," similar to WORMs (Write Once, Read Many):
- A. Hierarchical Instance Management (HIM).
- B. Hierarchical Access Management (HAM).
- C. Hierarchical Storage Management (HSM).
- D. Hierarchical Resource Management (HRM).
Answer: C
Explanation:
Hierarchical Storage Management (HSM) provides a continuous on-line backup by using optical or tape "jukeboxes," similar to WORMs.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 71.
NEW QUESTION 538
Who of the following is responsible for ensuring that proper controls are in place to address integrity, confidentiality, and availability of IT systems and data?
- A. Chief information officer
- B. IT Security practitioners
- C. System and information owners
- D. Business and functional managers
Answer: C
Explanation:
The system and information owners are responsible for ensuring that proper controls are in place to address integrity, confidentiality, and availability of the IT systems and data they own. IT security practitioners are responsible for proper implementation of security requirements in their IT systems.
Source: STONEBURNER, Gary et al., NIST Special publication 800-30, Risk management
Guide for Information Technology Systems, 2001 (page 6).
NEW QUESTION 539
Which of the following countermeasures is the MOST effective in defending against a social engineering attack?
- A. Evaluating security awareness training
- B. Changing individual behavior
- C. Mandating security policy acceptance
- D. Filtering malicious e-mail content
Answer: A
Explanation:
Explanation/Reference:
NEW QUESTION 540
Which of the following is the BEST way to reduce the impact of an externally sourced flood attack?
- A. Block all inbound traffic until the flood ends.
- B. Block the soiree address at the firewall.
- C. Have the service provider block the soiree address.
- D. Have the soiree service provider block the address.
Answer: B
NEW QUESTION 541
What physical characteristics does a retinal scan biometric device measure?
- A. The pattern of blood vessels at the back of the eye
- B. The amount of light reflected by the retina
- C. The amount of light reaching the retina
- D. The size, curvature, and shape of the retina
Answer: A
NEW QUESTION 542
An associative memory operates in which one of the following ways?
- A. Searches for values in memory exceeding a specified value
- B. Searches for a specific data value in memory
- C. Uses indirect addressing only
- D. Returns values stored in a memory address location specified in the CPU address register
Answer: B
Explanation:
Answer a refers to an addressing mode used in computers where the address location that is specified in the program instruction contains the address of the final desired location.
* Answer "Searches for values in memory exceeding a specified value" is a distracter and answer "Returns values stored in a memory address location specified in the CPU address register" is the description of the direct or absolute addressing mode.
NEW QUESTION 543
Several methods provide telecommunications continuity, which of the following is a method of routing traffic through split cable or duplicate cable facilities?
- A. long haul network diversity
- B. alternative routing
- C. last mile circuit protection
- D. diverse routing
Answer: D
NEW QUESTION 544
Which access control method allows the data owner (the person who created the file) to control access to the information they own?
- A. NDAC - Non-Discretionary Access Control
- B. MAC - Mandatory Access Control
- C. DAC - Discretionary Access Control
- D. RBAC - Role-Based Access Control
Answer: C
Explanation:
DAC - Discretionary Access Control is where the user controls access to the data they create or manage.
It is the least secure method of access control because of a few factors:
-Employee changeover can lead to confusion of data ownership or abandoned data.
-Employees are not traditionally experienced enough to manage data permissions and maintain them in a reliable fashion.
-People in general are the least reliable component of any organization
The following answers are incorrect:
-MAC - Mandatory Access Control: This is incorrect because in the MAC model of access control, labels are used to identify the level of sensitivity of the data. If the user does not have privileges to such data he or she is denied access.
-RBAC - Role-Based Access Control: Sorry, RBAC is Role-Based Access Control where the users' Role determines the access level to data they are given.
-NDAC - Non-Discretionary Access Control: Sorry, this isn't a common term associated with access control methodologies.
The following reference(s) was used to create this question: 2013 Official Security+ Curriculum.
NEW QUESTION 545
Which of the following correctly describe "good" security practice?
- A. You should have a procedure in place to verify password strength.
- B. Accounts should be monitored regularly.
- C. You should ensure that there are no accounts without passwords.
- D. All of the choices.
Answer: D
Explanation:
In many organizations accounts are created and then nobody ever touches those accounts again. This is a very poor security practice. Accounts should be monitored regularly, you should look at unused accounts and you should have a procedure in place to ensure that departing employees have their rights revoke prior to leaving the company. You should also have a procedure in place to verify password strength or to ensure that there are no accounts without passwords.
NEW QUESTION 546
What would BEST define risk management?
- A. The process of eliminating the risk
- B. The process of assessing the risks
- C. The process of reducing risk to an acceptable level
- D. The process of transferring risk
Answer: C
Explanation:
This is the basic process of risk management.
Risk is the possibility of damage happening and the ramifications of such damage should it occur.
Information risk management (IRM) is the process of identifying and assessing risk, reducing it to
an acceptable level, and implementing the right mechanisms to maintain that level. There is no
such thing as a 100 percent secure environment. Every environment has vulnerabilities and
threats to a certain degree.
The skill is in identifying these threats, assessing the probability of them actually occurring and the
damage they could cause, and then taking the right steps to reduce the overall level of risk in the
environment to what the organization identifies as acceptable.
Proper risk management requires a strong commitment from senior management, a documented
process that supports the organization's mission, an information risk management (IRM) policy
and a delegated IRM team. Once you've identified your company's acceptable level of risk, you
need to develop an information risk management policy.
The IRM policy should be a subset of the organization's overall risk management policy (risks to a
company include more than just information security issues) and should be mapped to the
organizational security policies, which lay out the acceptable risk and the role of security as a
whole in the organization. The IRM policy is focused on risk management while the security policy
is very high-level and addresses all aspects of security. The IRM policy should address the
following items:
Objectives of IRM team
Level of risk the company will accept and what is considered an acceptable risk (as defined in the
previous article)
Formal processes of risk identification
Connection between the IRM policy and the organization's strategic planning processes
Responsibilities that fall under IRM and the roles that are to fulfill them
Mapping of risk to internal controls
Approach for changing staff behaviors and resource allocation in response to risk analysis
Mapping of risks to performance targets and budgets
Key indicators to monitor the effectiveness of controls
Shon Harris provides a 10,000-foot view of the risk management process below:
A big question that companies have to deal with is, "What is enough security?" This can be
restated as, "What is our acceptable risk level?" These two questions have an inverse relationship.
You can't know what constitutes enough security unless you know your necessary baseline risk
level.
To set an enterprise-wide acceptable risk level for a company, a few things need to be
investigated and understood. A company must understand its federal and state legal
requirements, its regulatory requirements, its business drivers and objectives, and it must carry out
a risk and threat analysis. (I will dig deeper into formalized risk analysis processes in a later article,
but for now we will take a broad approach.) The result of these findings is then used to define the
company's acceptable risk level, which is then outlined in security policies, standards, guidelines
and procedures.
Although there are different methodologies for enterprise risk management, the core components
of any risk analysis is made up of the following:
Identify company assets
Assign a value to each asset
Identify each asset's vulnerabilities and associated threats
Calculate the risk for the identified assets
Once these steps are finished, then the risk analysis team can identify the necessary
countermeasures to mitigate the calculated risks, carry out cost/benefit analysis for these
countermeasures and report to senior management their findings.
When we look at information security, there are several types of risk a corporation needs to be
aware of and address properly. The following items touch on the major categories:
Physical damage Fire, water, vandalism, power loss, and natural disasters
Human interaction Accidental or intentional action or inaction that can disrupt productivity
Equipment malfunction Failure of systems and peripheral devices
Inside and outside attacks Hacking, cracking, and attacking
Misuse of data Sharing trade secrets, fraud, espionage, and theft
Loss of data Intentional or unintentional loss of information through destructive means
Application error Computation errors, input errors, and buffer overflows
The following answers are incorrect:
The process of eliminating the risk is not the best answer as risk cannot be totally eliminated.
The process of assessing the risks is also not the best answer.
The process of transferring risk is also not the best answer and is one of the ways of handling a
risk after a risk analysis has been performed.
References:
Shon Harris , AIO v3 , Chapter 3: Security Management Practices , Page: 66-68
and
http://searchsecurity.techtarget.com/tip/Understanding-risk
NEW QUESTION 547
Which statement is correct about ISDN Basic Rate Interface?
- A. It offers 1 B channel and 2 D channels.
- B. It offers 2 B channels and 1 D channel.
- C. It offers 30 B channels and 1 D channel.
- D. It offers 23 B channels and 1 D channel.
Answer: B
Explanation:
Integrated Services Digital Network (ISDN) Basic Rate Interface
(BRI) offers two B channels which carry user data at 64 Kbps each,
and one control and signaling D channel operating at 16 Kbps.
Answer "It offers 23 B channels and 1 D channel." describes ISDN Primary Rate Interface
(PRI) for NorthAmerica and Japan , with 23 B channels at 64 Kbps and one 64 Kbps D channel, for a total throughput of 1.544 Mbps.
Answer "It offers 30 B channels and 1 D channel." Describes ISDN PRI for Europe ,
Australia , and other parts of the world, with 30 64 Kbps B channels and one D channel, for a total throughput of 2.048 Mbps.
Answer "It offers 1 B channel and 2 D channels." is a distracter. Source: Internetworking
Technologies Handbook, Second Edition (Cisco Press, 1998).
NEW QUESTION 548
ICMP and IGMP belong to which layer of the OSI model?
- A. Data Link Layer.
- B. Datagram Layer.
- C. Network Layer.
- D. Transport Layer.
Answer: C
Explanation:
Explanation/Reference:
Explanation:
ICMP and IGMP work at the network layer of the OSI model.
Incorrect Answers:
A: There is no Datagram Layer in the OSI model.
C: ICMP and IGMP do not belong to the Transport layer of the OSI model. TCP and UDP are examples of protocols working at the transport layer.
D: ICMP and IGMP do not belong to the Transport layer of the OSI model. ARP, OSOF, and MAC are examples of protocols workings at the data link layer.
References:
https://en.wikipedia.org/wiki/Network_layer
NEW QUESTION 549
......
Information related to the ISC CISSP Certification
- CISSP More than 4 million case studies were published in leading journals.
- ISC Certification has been on the rise since 2010, with over 8,000 individuals certified globally each year on average.
- CISSP More than 1 million research papers referenced in security literature.
- CISSP More than 8 million person-years of cyber security work experience.
ISC CISSP Growth Plans ISC is actively expanding its certification program to reach more international professionals across the globe. The CISSP Dumps can assist you during the period of preparation for the exam CISSP. The first step toward this goal was to create an exam that is available in English, French, Spanish, Portuguese, and Chinese. ISC has also partnered with other leading certification bodies around the globe to offer the exam locally. By partnering with local testing authorities, ISC can provide exams in multiple languages for international candidates. Enrolling test centers offer ISC the opportunity to build a successful program around the globe.
The NCC Group, one of the world's leading independent information security consulting firms, is ISC official testing center liaison. It provides candidates in the United Kingdom with exam registration and exam delivery options. ISC has an agreement with Accredia, a leader in IT certification delivery, to handle test scheduling and operational tasks for candidates who wish to take the CISSP exam in South Africa.
Free Exam Files Downloaded Instantly: https://www.practicevce.com/ISC/CISSP-practice-exam-dumps.html
CISSP Free Exam Questions with Quality Guaranteed: https://drive.google.com/open?id=1SKHTgjDMx0CPiPtQr-QV5q37VhuOaDHK