[Nov-2024] CISSP Dumps PDF - CISSP Real Exam Questions Answers
CISSP Dumps 100% Pass Guarantee With Latest Demo
NEW QUESTION # 465
Which of the following should be the FIRST response to the detection of a major security incident on a system?
- A. Acquire a forensic image of the disk storage.
- B. Immediately power off and take it to the lab.
- C. Acquire a forensic image of the volatile memory.
- D. Capture the details of open ports and running processes.
Answer: B
NEW QUESTION # 466
The "vulnerability of a facility" to damage or attack may be assessed by all of the following except:
- A. Security controls
- B. security budget
- C. Inspection
- D. History of losses
Answer: B
Explanation:
Source: The CISSP Examination Textbook- Volume 2: Practice by S. Rao
Vallabhaneni.
NEW QUESTION # 467
In order to ensure the privacy and integrity of the data, connections between firewalls over public networks should use:
- A. Encryption
- B. Screened subnets
- C. An encrypted Virtual Private Network
- D. Digital certificates
Answer: C
Explanation:
Virtual Private Networks allow a trusted network to communicate with another trusted network over untrusted networks such as the Internet. Screened Subnet: A screened subnet is essentially the same as the screened host architecture, but adds an extra strata of security by creating a network which the bastion host resides (often call perimeter network) which is separated from the internal network. A screened subnet will be deployed by adding a perimeter network in order to separate the internal network from the external. This assures that if there is a successful attack on the bastion host, the attacker is restricted to the perimeter network by the screening router that is connected between the internal and perimeter network. Digital Certificates: Digital Certificates will be used in the intitial steps of establishing a VPN but they would not provide the encryption and integrity by themselves. Encryption: Even thou this seems like a choice that would include the other choices, encryption by itself does not provide integrity mechanims. So encryption would satisfy only half of the requirements of the question. Source: TIPTON, Harold F. & KRAUSE, Micki, Information Security Management Handbook, 4th edition (volume 1), 2000, CRC Press, Chapter 3, Secured Connections to External Networks (page 65).
NEW QUESTION # 468
Why is lexical obfuscation in software development discouraged by many organizations?
- A. Problems writing test cases
- B. Problems recovering systems after disaster
- C. Problems maintaining data connections
- D. Problems compiling the code
Answer: B
Explanation:
Lexical obfuscation is a software development technique that involves changing the names of variables, functions, classes, or other identifiers in the source code to make them obscure or meaningless, such as using random letters or numbers. Lexical obfuscation is often used to protect the intellectual property of the software, or to prevent reverse engineering or tampering by attackers. However, lexical obfuscation is discouraged by many organizations because it can cause problems recovering systems after disaster. Lexical obfuscation can make the source code unreadable and incomprehensible, which can hamper the debugging, testing, maintenance, and documentation of the software. Lexical obfuscation can also make the recovery of the software more difficult and time-consuming, especially if the original names of the identifiers are lost or unavailable. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 8: Software Development Security, page 433; [Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 8: Software Development Security, page 573]
NEW QUESTION # 469
Which of the following is NOT a preventive operational control?
- A. Controlling data media access and disposal.
- B. Conducting security awareness and technical training.
- C. Protecting laptops, personal computers and workstations.
- D. Controlling software viruses.
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Conducting security awareness and technical training to ensure that end users and system users are aware of the rules of behavior and their responsibilities in protecting the organization's mission is an example of a preventive management control, therefore not an operational control.
Incorrect Answers:
A: Protecting laptops, personal computers and workstations is an example of a preventive operational control.
B: Controlling software viruses is an example of a preventive operational control.
C: Controlling data media access and disposal is an example of a preventive operational control.
NEW QUESTION # 470
Which statement is NOT true about the SOCKS protocol?
- A. It is sometimes referred to as an application-level proxy.
- B. It operates in the transport layer of the OSI model.
- C. It uses an ESP for authentication and encryption.
- D. Network applications need to be SOCKS-ified to operate.
Answer: C
Explanation:
The correct answer is "It uses an ESP for authentication and encryptio". The Encapsulating
Security Payload, (ESP) is a component of IPSec. Socket Security (SOCKS) is a transport layer, secure networking proxy protocol. SOCKS replaces the standard network systems calls with its own calls. These calls open connections to a SOCKS proxy server for client authentication, transparently to the user.
Common network utilities, like TELNET or FTP, need to be SOCKSified,
or have their network calls altered to recognize SOCKS proxy calls.
Source: Designing Network Security by Merike Kaeo (Cisco Press, 1999).
NEW QUESTION # 471
What does the Spiral Model depict?
- A. Information security checklists
- B. The operation of expert systems
- C. Aspiral that models the behavior of biological neurons
- D. Aspiral that incorporates various phases of software development
Answer: D
Explanation:
The correct answer is a a spiral that incorporates various phases of software development. The other answers are distracters.
NEW QUESTION # 472
An organization is outsourcing its payroll system and is requesting to conduct a full audit on the third-party information technology (IT) systems. During the due diligence process, the third party provides previous audit report on its IT system.
Which of the following MUST be considered by the organization in order for the audit reports to be acceptable?
- A. The audit reports have been issued in the last six months.
- B. The audit assessment has been conducted by an international audit firm.
- C. The audit assessment has been conducted by an independent assessor.
- D. The audit reports have been signed by the third-party senior management.
Answer: C
NEW QUESTION # 473
The goal of cryptanalysis is to ____________.
- A. Determine the number of encryption permutations required
- B. Reduce the system overhead for a crypto-system
- C. Choose the correct algorithm for a specified purpose
- D. Forge coded signals that will be accepted as authentic
- E. Develop secure crypto-systems
Answer: D
Explanation:
The goal of cryptanalysis is to forge coded signals that will be accepted as authentic.
NEW QUESTION # 474
What physical characteristic does a retinal scan biometric device measure?
- A. The pattern of blood vessels at the back of the eye
- B. The pattern of light receptors at the back of the eye
- C. The size, curvature, and shape of the retina
- D. The amount of light reflected by the retina
Answer: A
NEW QUESTION # 475
A prolonged power supply that is below normal voltage is a:
- A. brownout
- B. blackout
- C. surge
- D. fault
Answer: A
NEW QUESTION # 476
When referring to the Cloud Computing Service models. What would you call a service model where the consumer does not manage or control the underlying cloud infrastructure including networks, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment?
- A. Software as a Service (SaaS)
- B. Platform as a Service (PaaS)
- C. Code as a Service (CaaS)
- D. Infrastructure as a Service (IaaS)
Answer: B
Explanation:
The capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages, libraries, services, and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including networks, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment.
Platform-as-a-Service (PaaS) is a model of service delivery whereby the computing platform is provided as an on-demand service upon which applications can be developed and deployed. Its main purpose is to reduce the cost and omplexity of buying, housing, and managing the underlying hardware and software components of the platform, including any needed program and database development tools. The development environment is typically special purpose, determined by the cloud provider and tailored to the design and architecture of its platform. The cloud consumer has control over applications and application environment settings of the latform. Security provisions are split between the cloud provider and the cloud consumer.
The following answers are incorrect: Software-as-a-Service.
Software-as-a-Service (SaaS) is a model of service delivery whereby one or more applications and the computational resources to run them are provided for use on demand as a turnkey service. Its main purpose is to reduce the total cost of hardware and software development, maintenance, and operations. Security provisions are carried out mainly by the cloud provider. The cloud consumer does not manage or control the underlying cloud infrastructure or individual applications, except for preference selections and limited administrative application settings. Infrastructure-as-a-Service. Infrastructure-as-a-Service (IaaS) is a model of service delivery whereby the basic computing infrastructure of servers, software, and network equipment is provided as an on-demand service upon which a platform to develop and execute applications can be established. Its main purpose is to avoid purchasing, housing, and managing the basic hardware and software infrastructure components, and instead obtain those resources as virtualized objects controllable via a service interface. The cloud consumer generally has broad freedom to choose the operating system and development environment to be hosted. Security provisions beyond the basic infrastructure are carried out mainly by the cloud consumer Code as a Service (CaaS) CaaS does not exist and is only a detractor. This is no such service model.
Cloud Deployment Models
NOTE: WHAT IS A CLOUD INFRASTRUCTURE? A cloud infrastructure is the collection of hardware and software that enables the five essential characteristics of cloud computing. The cloud infrastructure can be viewed as containing both a physical layer and an abstraction layer. The physical layer consists of the hardware resources that are necessary to support the cloud services being provided, and typically includes server, storage and network components. The abstraction layer consists of the software deployed across the physical layer, which manifests the essential cloud characteristics. Conceptually the abstraction layer sits above the physical layer.
The following reference(s) were/was used to create this question: NIST Special Publication 800-144 Guidelines on Security and Privacy in Public Cloud Computing and NIST Special Publication 800-145 The NIST definition of Cloud Computing
NEW QUESTION # 477
What is the MAIN purpose of a change control/management system?
- A. Notify all interested parties of the completion of the change.
- B. Ensure the orderly processing of a change request.
- C. Document the change for audit and management review.
- D. Ensure that the change meets user specifications.
Answer: C
NEW QUESTION # 478
An example of two-factor authentication is:
- A. A PIN and an ATM card.
- B. A password and an I
- C. An ID and a PIN.
- D. A finger print.
Answer: A
Explanation:
The correct answer is "APIN and an ATM card". These items are something you know and something you have. Answer "A password and an ID" is incorrect because essentially, only one factor is being used: something you know (password.).
Answer "An ID and a PIN" is incorrect for the same reason. Answer "A finger print" is incorrect because only one biometric factor is being used.
NEW QUESTION # 479
An organization decides to implement a partial Public Key Infrastructure (PKI) with only the servers having digital certificates. What is the security benefit of this implementation?
- A. Mutual authentication is available between the clients and servers.
- B. Servers are able to issue digital certificates to the client.
- C. Clients can authenticate themselves to the servers.
- D. Servers can authenticate themselves to the client.
Answer: D
NEW QUESTION # 480
Which of the following assessment metrics is BEST used to understand a system's vulnerability to potential exploits?
- A. Quantifying the system's available services
- B. Determining the probability that the system functions safely during any time period
- C. Identifying the number of security flaws within the system
- D. Measuring the system's integrity in the presence of failure
Answer: C
NEW QUESTION # 481
To what does logon abuse refer?
- A. Legitimate users accessing networked services that would normally
be restricted to them - B. Breaking into a network primarily from an external source
- C. Intrusions via dial-up or asynchronous external network connections
- D. Nonbusiness or personal use of the Internet
Answer: A
Explanation:
The correct answer is "Legitimate users accessing networked services that would normally be restricted to them". Logon abuse entails an otherwise proper user attempting to access areas of the network that are deemed offlimits.
Answer "Breaking into a network primarily from an external source" is called network intrusion, and d refers to backdoor remote access.
NEW QUESTION # 482
A Business Continuity Plan/Disaster Recovery Plan (BCP/DRP) will provide which of the following?
- A. Guaranteed recovery of all business functions
- B. Protection from loss of organization resources
- C. Minimization of the need decision making during a crisis
- D. Insurance against litigation following a disaster
Answer: C
Explanation:
Minimization of the need for decision making during a crisis is the main benefit that a Business Continuity Plan/Disaster Recovery Plan (BCP/DRP) will provide. A BCP/DRP is a set of policies, procedures, and resources that enable an organization to continue or resume its critical functions and operations in the event of a disruption or disaster. A BCP/DRP can provide several benefits, such as:
* Improving the resilience and preparedness of the organization and its staff in handling a disruption or disaster
* Enhancing the performance and efficiency of the organization and its systems in recovering from a disruption or disaster
* Increasing the compliance and alignment of the organization and its plans with the internal or external requirements and standards
* Facilitating the monitoring and improvement of the organization and its plans by identifying and addressing any gaps, issues, or risks Minimization of the need for decision making during a crisis is the main benefit that a BCP/DRP will provide, because it can ensure that the organization and its staff have a clear and consistent guidance and direction on how to respond and act during a disruption or disaster, and avoid any confusion, uncertainty, or inconsistency that might worsen the situation or impact. A BCP/DRP can also help to reduce the stress and pressure on the organization and its staff during a crisis, and increase their confidence and competence in executing the plans.
The other options are not the benefits that a BCP/DRP will provide, but rather unrealistic or incorrect expectations or outcomes of a BCP/DRP. Guaranteed recovery of all business functions is not a benefit that a BCP/DRP will provide, because it is not possible or feasible to recover all business functions after a disruption or disaster, especially if the disruption or disaster is severe or prolonged. A BCP/DRP can only prioritize and recover the most critical or essential business functions, and may have to suspend or terminate the less critical or non-essential business functions. Insurance against litigation following a disaster is not a benefit that a BCP/DRP will provide, because it is not a guarantee or protection that the organization will not face any legal or regulatory consequences or liabilities after a disruption or disaster, especially if the disruption or disaster is caused by the organization's negligence or misconduct. A BCP/DRP can only help to mitigate or reduce the legal or regulatory risks, and may have to comply with or report to the relevant authorities or parties.
Protection from loss of organization resources is not a benefit that a BCP/DRP will provide, because it is not a prevention or avoidance of any damage or destruction of the organization's assets or resources during a disruption or disaster, especially if the disruption or disaster is physical or natural. A BCP/DRP can only help to restore or replace the lost or damaged assets or resources, and may have to incur some costs or losses.
NEW QUESTION # 483
What is defined as inference of information from other, intermediate, relevant facts?
- A. Secondary evidence
- B. Circumstantial evidence
- C. Hearsay evidence
- D. Conclusive evidence
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Circumstantial evidence is defined as inference of information from other, intermediate, relevant facts.
Secondary evidence is a copy of evidence or oral description of its contents. Conclusive evidence is incontrovertible and overrides all other evidence and hearsay evidence is evidence that is not based on personal, first-hand knowledge of the witness, but was obtained from another source. Computer-generated records normally fall under the category of hearsay evidence.
References: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security,John Wiley & Sons, 2001, Chapter 9: Law, Investigation, and Ethics (page 310)
NEW QUESTION # 484
......
Exam Outline
According to the vendor, the CISSP test is available in two options: CAT (English exam) and Linear (test in other languages). As for the CAT variation, it has 100-150 questions in multiple-choice and advances innovative formats. The exam duration is 3 hours. The passing score for this test is 700 out of 1000 points. When it comes to the Linear exam, it will last for 6 hours with 250 items to complete. In all, the candidates who prepare for either exam variation are expected to have in-depth knowledge of software development security and its risks across eight security areas, which are as follows:
- Security Testing and Assessment;
- Risk Management alongside Security Concepts;
- Security for Software Development.
- Engineering & Security Architecture;
- Identity & Access Management;
- Operations for Security;
Finally, you can schedule your CISSP certification exam by creating a Pearson VUE account. Make sure you can then select your nearest testing center.
Dumps Real ISC CISSP Exam Questions [Updated 2024]: https://www.testpassed.com/CISSP-still-valid-exam.html
Prepare CISSP Question Answers Free Update With 100% Exam Passing Guarantee [2024]: https://drive.google.com/open?id=1g190q4LDfO_RddWOB8q8jEWR7azf7523