100% Free CISSP Files For passing the exam Quickly UPDATED Sep 12, 2022
CISSP Dumps Questions Study Exam Guide
Total Number of Questions in the ISC CISSP exam
The number of questions is 100-150.
What to Get: (ISC)2 CISSP Certification Benefits
After gaining the required work experience, successfully passing the (ISC)2 CISSP exam and finally getting endorsement, you will become eligible for the CISSP certification. Some of the most popular positions you can apply for after getting certified include the following:
- Internal Auditor;
- Network Architect;
- Cybersecurity Forensic Analyst;
- Chief Information Officer;
- Cloud Security Administrator.
Having the CISSP certification under your belt can also have a great impact on the financial bottom line after successfully completing the exam. Those who hold this sought-after certificate can earn an average salary of about $101,000.
NEW QUESTION 342
Which of the following can be defined as THE unique attribute used as a unique identifier within a given table to identify a tuple?
- A. secondary key
- B. primary key
- C. foreign key
- D. candidate key
Answer: B
Explanation:
The following answers were NOT correct:
Candidate Key: A candidate key is a combination of attributes that can be uniquely used to identify a database record without any extraneous data. Each table may have one or more candidate keys. One of these candidate keys is selected as the table primary key.
Foreign Key: A foreign key is a field in a relational table that matches the primary key column of another table. The foreign key can be used to cross-reference tables.
Secondary key: The term secondary key is a key that is used strictly for data-retrieval purposes. A secondary key is sometimes defined as a "data item value that identifies a set of records." It is important to note that a secondary key does not need to have unique values in a table; in this respect, secondary keys differ from primary keys (and candidate keys and superkeys).
References:
A candidate key is an attribute that is a unique identifier within a given table.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 45.
Candidate Key Ref: http://databases.about.com/cs/specificproducts/g/candidate.htm
Feedback from Jerry: A candidate key is one of several alternative columns in a table that may be chosen as a primary key. The PRIMARY KEY IS the unique identifier. The foundation of a relational database is the establishiment and reliance on a unique primary key, not candidate keys. Primary key is a more correct answer to this question than candidate key.
Secondary key ref: http://www.gslis.utexas.edu/~wyllys/DMPAMaterials/keys.html
NEW QUESTION 343
What is the MOST critical factor to achieve the goals of a security program?
- A. Budget approved for security resources
- B. Executive management support
- C. Capabilities of security resources
- D. Effectiveness of security management
Answer: B
NEW QUESTION 344
Which one of the following is NOT one of the maturity levels of the
Software Capability Maturity Model (CMM)?
- A. Managed
- B. Fundamental
- C. Defined
- D. Repeatable
Answer: B
Explanation:
The correct answer is Fundamental, a distracter. The first level of the Software
CMM is the Initiating level. At this level, processes are performed on
an ad hoc basis.
Answer the Repeatable level is the second maturity
level in the model. In the third level, Defined, management
practices are institutionalized and technical procedures are
integrated into the organizational structurE. The Managed level
has both product and processes quantitatively controlled.
The fifth level of the Software CMM is the Optimized level, where
continuous process improvement is institutionalized.
NEW QUESTION 345
What kind of certificate is used to validate a user identity?
- A. Root certificate
- B. Public key certificate
- C. Attribute certificate
- D. Code signing certificate
Answer: B
Explanation:
In cryptography, a public key certificate (or identity certificate) is an electronic document which incorporates a digital signature to bind together a public key with an identity - information such as the name of a person or an organization, their address, and so forth. The certificate can be used to verify that a public key belongs to an individual.
In a typical public key infrastructure (PKI) scheme, the signature will be of a certificate authority (CA). In a web of trust scheme, the signature is of either the user (a self-signed certificate) or other users ("endorsements"). In either case, the signatures on a certificate are attestations by the certificate signer that the identity information and the public key belong together.
In computer security, an authorization certificate (also known as an attribute certificate) is a digital document that describes a written permission from the issuer to use a service or a resource that the issuer controls or has access to use. The permission can be delegated.
Some people constantly confuse PKCs and ACs. An analogy may make the distinction clear. A PKC can be considered to be like a passport: it identifies the holder, tends to last for a long time, and should not be trivial to obtain. An AC is more like an entry visa: it is typically issued by a different authority and does not last for as long a time. As acquiring an entry visa typically requires presenting a passport, getting a visa can be a simpler process.
A real life example of this can be found in the mobile software deployments by large service providers and are typically applied to platforms such as Microsoft Smartphone (and related), Symbian OS, J2ME, and others.
In each of these systems a mobile communications service provider may customize the mobile terminal client distribution (ie. the mobile phone operating system or application environment) to include one or more root certificates each associated with a set of capabilities or permissions such as "update firmware", "access address book", "use radio interface", and the most basic one, "install and execute". When a developer wishes to enable distribution and execution in one of these controlled environments they must acquire a certificate from an appropriate CA, typically a large commercial CA, and in the process they usually have their identity verified using out-of-band mechanisms such as a combination of phone call, validation of their legal entity through government and commercial databases, etc., similar to the high assurance SSL certificate vetting process, though often there are additional specific requirements imposed on would-be developers/publishers.
Once the identity has been validated they are issued an identity certificate they can use to sign their software; generally the software signed by the developer or publisher's identity certificate is not distributed but rather it is submitted to processor to possibly test or profile the content before generating an authorization certificate which is unique to the particular software release. That certificate is then used with an ephemeral asymmetric key-pair to sign the software as the last step of preparation for distribution. There are many advantages to separating the identity and authorization certificates especially relating to risk mitigation of new content being accepted into the system and key management as well as recovery from errant software which can be used as attack vectors.
References:
HARRIS, Shon, All-In-One CISSP Certification Exam Guide, 2001, McGraw-Hill/Osborne, page 540.
http://en.wikipedia.org/wiki/Attribute_certificate
http://en.wikipedia.org/wiki/Public_key_certificate
NEW QUESTION 346
In which order, from MOST to LEAST impacted, does user awareness training reduce the occurrence of the events below?
Answer:
Explanation:
Explanation
NEW QUESTION 347
What can be defined as a data structure that enumerates digital certificates that were issued to CAs but have been invalidated by their issuer prior to when they were scheduled to expire?
- A. Certificate revocation list
- B. Certificate revocation tree
- C. Untrusted certificate list
- D. Authority revocation list
Answer: D
Explanation:
The Internet Security Glossary (RFC2828) defines the Authority Revocation List (ARL) as a data structure that enumerates digital certificates that were issued to CAs but have been invalidated by their issuer prior to when they were scheduled to expire.
Do not to confuse with an ARL with a Certificate Revocation List (CRL). A certificate revocation list is a mechanism for distributing notices of certificate revocations. The question specifically mentions "issued to CAs" which makes ARL a better answer than CRL. http://rfclibrary.hosting.com/rfc/rfc2828/rfc2828-29.asp $ certificate revocation list (CRL)
(I)
A data structure that enumerates digital certificates that have been invalidated by their issuer prior to when they were scheduled to expire. (See: certificate expiration, X.509 certificate revocation list.)
http://rfclibrary.hosting.com/rfc/rfc2828/rfc2828-17.asp $ authority revocation list (ARL)
(I)
A data structure that enumerates digital certificates that were issued to CAs but have been
invalidated by their issuer prior to when they were scheduled to expire. (See: certificate expiration,
X.509 authority revocation list.)
In a few words: We use CRL's for end-user cert revocation and ARL's for CA cert revocation - both
can be placed in distribution points.
NEW QUESTION 348
Which choice below most accurately describes a business continuity
program?
- A. A standard that allows for rapid recovery during system interruption and data loss
- B. A determination of the effects of a disaster on human, physical, economic, and natural resources
- C. A program that implements the mission, vision, and strategic goals of the organization
- D. Ongoing process to ensure that the necessary steps are taken to identify the impact of potential losses and maintain viable recovery
Answer: D
Explanation:
A business continuity program is an ongoing process supported by senior management and funded to ensure that the necessary steps are taken to identify the impact of potential losses, maintain viable recovery strategies and recovery plans, and ensure continuity of services through personnel training, plan testing, and maintenance. Answer "A program that implements the mission, vision, and strategic goals of the organization" describes a disaster/emergency management program. A disaster/ emergency management program, like a disaster recovery program, is a program that implements the mission, vision, and strategic goals and objectives as well as the management framework of the program and organization. *Answer "A determination of the effects of a disaster on human, physical, economic, and natural resources" describes a damage assessment. A damage assessment is an appraisal or determination of the effects of a disaster on human, physical, economic, and natural resources. *Answer "A standard that allows for rapid recovery during system interruption and data loss" is a distracter. Source: NFPA1600 Standard on Disaster/Emergency Management and Business Continuity, National Fire Protection Association, 2000 edition.
NEW QUESTION 349
Making sure that the data has not been changed unintentionally, due to an accident or malice is:
- A. Availability.
- B. Confidentiality.
- C. Auditability.
- D. Integrity.
Answer: D
Explanation:
Integrity refers to the protection of information from unauthorized modification or deletion. Confidentiality is incorrect. Confidentiality refers to the protection of information from unauthorized disclosure.
Availability is incorrect. Availability refers to the assurance that information and services will be available to authorized users in accordance with the service level objective.
Auditability is incorrect. Auditability refers to the ability to trace an action to the identity that performed it and identify the date and time at which it occurred.
References: CBK, pp. 5 - 6 AIO3, pp. 56 - 57
NEW QUESTION 350
In what way could Java applets pose a security threat?
- A. Java interpreters do not provide the ability to limit system access that an applet could have on a client system.
- B. Their transport can interrupt the secure distribution of World Wide Web pages over the Internet by removing SSL and S-HTTP
- C. Java does not check the bytecode at runtime or provide other safety mechanisms for program isolation from the client system.
- D. Executables from the Internet may attempt an intentional attack when they are downloaded on a client system.
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Programmers have figured out how to write applets that enable the code to access hard drives and resources that are supposed to be protected by the Java security scheme. This code can be malicious in nature and cause destruction and mayhem to the user and her system.
Incorrect Answers:
A: The transportation of an applet cannot remove SSL or S-HTTP.
B: When an applet is executed, the JVM will create a virtual machine, which provides an environment called a sandbox. This virtual machine is an enclosed environment in which the applet carries out its activities.
D: The Java Virtual Machine (JVM) converts the bytecode to the machine code that the processor on that particular system can understand.
References:
Conrad, Eric, Seth Misenar and Joshua Feldman, CISSP Study Guide, 2nd Edition, Syngress, Waltham,
2012, p. 1155
NEW QUESTION 351
Unused space in a disk cluster is important in media analysis because it may contain which of the following?
- A. Information about patches and upgrades to the system
- B. Hidden viruses and Trojan horses
- C. Residual data that has not been overwritten
- D. Information about the File Allocation table (FAT)
Answer: C
Explanation:
Section: Asset Security
NEW QUESTION 352
Which of the following is MOST important when assigning ownership of an asset to a department?
- A. All members should be trained on their responsibilities
- B. The department should report to the business owner
- C. Individual accountability should be ensured
- D. Ownership of the asset should be periodically reviewed
Answer: A
NEW QUESTION 353
In the Common Criteria, a Protection Profile:
- A. Is also known as the Orange Book.
- B. Specifies the mandatory protection in the product to be evaluated.
- C. Specifies the security requirements and protections of the products to be evaluated.
- D. Is also known as the Target of Evaluation (TOE).
Answer: C
Explanation:
Answer "Specifies the mandatory protection in the product to be evaluated" is a distracter.
*Answer "Is also known as the Target of Evaluation (TOE)" is the product to be evaluated.
*Answer "Is also known as the Orange Book" refers to TCSEC.
NEW QUESTION 354
Making sure that the data is accessible when and where it is needed is which of the following?
- A. Confidentiality
- B. Availability
- C. Integrity
- D. Acceptability
Answer: B
Explanation:
This is one of the pillars of network security. We can say that the data is available if we can access to it when we need it. This what is referred in the question, Availability refers to get access to data when and where you need it.
Confidentiality deals with encryption and data protection against third party interception. Integrity deals with digital signatures and assures that the data has not changed. Acceptability is not a related term.
NEW QUESTION 355
A shared resource matrix is a technique commonly used to locate:
- A. Security flaws
- B. Covert channels
- C. Trap doors
- D. Malicious code
Answer: B
Explanation:
Analyzing resources of a system is one standard for locating covert channels because the basis of a covert channel is a shared resource.
The following properties must hold for a storage channel to exist:
1.Both sending and receiving process must have access to the same attribute of a shared object.
2.The sending process must be able to modify the attribute of the shared object.
3.The receiving process must be able to reference that attribute of the shared object.
4.A mechanism for initiating both processes and properly sequencing their respective accesses to the shared resource must exist.
Note: Similar properties for timing channel can be listed
The following answers are incorrect:
All other answers were not directly related to discovery of Covert Channels.
The following reference(s) were/was used to create this question:
Auerbach Publications, Auerbach Publications (Test Series) - CRC Press LLC, Page No. 225
and
http://www.cs.ucsb.edu/~sherwood/cs290/papers/covert-kemmerer.pdf
and
http://www.cs.utexas.edu/~byoung/cs361/lecture16.pdf
and
http://www.cs.utexas.edu/~byoung/cs361/lecture16.pdf
NEW QUESTION 356
An Ethernet address is composed of how many bits?
- A. 64-bit address
- B. 32-bit address.
- C. 48-bit address
- D. 128-bit address
Answer: C
Explanation:
An Ethernet address is a 48-bit address that is hard-wired into the Network Interface Cards
(NIC) of the network node.
A Media Access Control address (MAC address) is a unique identifier assigned to network interfaces for communications on the physical network segment. MAC addresses are used for numerous network technologies and most IEEE 802 network technologies, including
Ethernet. Logically, MAC addresses are used in the Media Access Control protocol sub- layer of the OSI reference model.
MAC addresses are most often assigned by the manufacturer of a network interface card
(NIC) and are stored in its hardware, the card's read-only memory, or some other firmware mechanism. If assigned by the manufacturer, a MAC address usually encodes the manufacturer's registered identification number and may be referred to as the burned-in address. It may also be known as an Ethernet hardware address (EHA), hardware address or physical address. A network node may have multiple NICs and will then have one unique MAC address per NIC.
MAC addresses are formed according to the rules of one of three numbering name spaces managed by the Institute of Electrical and Electronics Engineers (IEEE): MAC-48, EUI-48, and EUI-64. The IEEE claims trademarks on the names EUI-48 and EUI-64, in which EUI is an abbreviation for Extended Unique Identifier.
Reference(s) used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, 2001, John Wiley & Sons, Page 87.
and
https://en.wikipedia.org/wiki/MAC_address
NEW QUESTION 357
DRAG DROP
Drag the following Security Engineering terms on the left to the BEST definition on the right.
Answer:
Explanation:
NEW QUESTION 358
The term failover refers to:
- A. Terminating processing in a controlled fashion.
- B. Switching to a duplicate, hot backup component.
- C. A fail-soft system.
- D. Resiliency.
Answer: B
Explanation:
The correct answer is "Switching to a duplicate, hot backup component". Failover means switching to a hot backup system that maintains duplicate states with the primary system.
Answer "Terminating processing in a controlled fashion" refers to fail safe, and answers
Resiliency and A fail-soft system refer to fail soft.
NEW QUESTION 359
Which of the following was the FIRST mathematical model of a multilevel security policy used to define the concepts of a security state and mode of access, and to outline rules of access?
- A. Clark-Wilson
- B. Biba
- C. Bell-LaPadula
- D. State machine
Answer: C
Explanation:
Explanation/Reference:
Explanation:
In the 1970s, the U.S. military used time-sharing mainframe systems and was concerned about the security of these systems and leakage of classified information. The Bell-LaPadula model was developed to address these concerns. It was the first mathematical model of a multilevel security policy used to define the concept of a secure state machine and modes of access, and outlined rules of access. Its development was funded by the U.S. government to provide a framework for computer systems that would be used to store and process sensitive information. The model's main goal was to prevent secret information from being accessed in an unauthorized manner.
A system that employs the Bell-LaPadula model is called a multilevel security system because users with different clearances use the system, and the system processes data at different classification levels.
Incorrect Answers:
A: The Biba Model is an integrity model. This is not what is described in the question.
C: The Clark-Wilson Model is an integrity model. This is not what is described in the question.
D: State machine is not a specific model; it is a type of model. For example, the Bell-LaPadula model is a state machine model.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 369
NEW QUESTION 360
Which of the following is a process within a Systems Engineering Life Cycle (SELC) stage?
- A. Requirements Analysis
- B. Production Operations
- C. Development and Deployment
- D. Utilization Support
Answer: A
NEW QUESTION 361
Which type of security testing is being performed when an ethical hacker has no knowledge about the target system but the testing target is notified before the test?
- A. White box
- B. Reversal
- C. Gray box
- D. Blind
Answer: D
Explanation:
Section: Software Development Security
NEW QUESTION 362
Which software development model is actually a meta-model that incorporates a number of the software development models?
- A. The modified Waterfall model
- B. The Spiral model
- C. The Waterfall model
- D. The Critical Path Model (CPM)
Answer: B
Explanation:
Explanation/Reference:
Explanation:
The spiral model is a risk-driven process model generator for software projects. Thus, the incremental, waterfall, prototyping, and other process models are special cases of the spiral model that fit the risk patterns of certain projects.
Incorrect Answers:
A: The Waterfall model is a special case of the Spiral model, not the opposite way around.
B: The modified Waterfall model is a special case of the Spiral model, not the opposite way around.
D: A critical path model is not a meta-model. The critical path model requires you to establish the time frame for a project and schedule start and end times for each task in the project.
References:
https://en.wikipedia.org/wiki/Spiral_model
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 1112, 1115-
1116
NEW QUESTION 363
Which of the following provides the MOST comprehensive filtering of Peer-to-Peer (P2P) traffic?
- A. Access layer switch
- B. Application proxy
- C. Port filter
- D. Network boundary router
Answer: B
NEW QUESTION 364
......
How could you focus on ISC CISSP Certification Exam
Right here is the exam overview for ISC CISSP Certification Exam
ISC CISSP Certification Exam: Get our snappy guide in the event that you don't have the opportunity to peruse all the page
The CISSP certification was developed by the International Information Systems Security Certification Consortium (ISC) and is widely considered one of the most difficult certifications to attain. The CISSP exam tests for knowledge of concepts such as network security, software security, cryptography, physical security, and general security principles. Candidates must pass a rigorous 8-hour long exam and demonstrate proficiency in at least 10 out of 12 knowledge areas. This article will provide you with some useful tips on how to prepare for the ISC CISSP certification exam by studying CISSP Dumps and what to expect during the day of your test.
CISSP Premium Exam Engine - Download Free PDF Questions: https://www.prepawaytest.com/ISC/CISSP-practice-exam-dumps.html
Instant Download CISSP Free Updated Test Dumps: https://drive.google.com/open?id=1Hs56Vez8Nu0yaBxeDG8R7QqV0oGyeHve