100% Pass Your CISSP Exam Dumps at First Attempt with PracticeTorrent
Penetration testers simulate CISSP exam PDF
NEW QUESTION # 593
Object-Oriented Database (OODB) systems:
- A. Consume minimal system resources.
- B. Require minimal learning time for programmers.
- C. Are useful in storing and manipulating complex data, such as images
and graphics. - D. Are ideally suited for text-only information.
Answer: C
Explanation:
The correct answer is "Are useful in storing and manipulating complex data, such as images and graphics". The other answers are false, because for answer "Are ideally suited for text-only information" relational databases are ideally suited to text-only information,
"Require minimal learning time for programmers" and "Consume minimal system resources". OODB systems have a steep learning curve and consume a large amount of system resources.
NEW QUESTION # 594
When should an application invoke re-authentication in addition to initial user authentication?
- A. Periodically during a session
- B. After a period of inactivity
- C. At the application sign-off
- D. For each business process
Answer: B
NEW QUESTION # 595
Which of the following is related to physical security and is not considered a technical control?
- A. Firewalls
- B. Access control Mechanisms
- C. Intrusion Detection Systems
- D. Locks
Answer: D
Explanation:
All of the above are considered technical controls except for locks, which are physical controls.
Administrative, Technical, and Physical Security Controls
Administrative security controls are primarily policies and procedures put into place to define and guide employee actions in dealing with the organization's sensitive information.
For example, policy might dictate (and procedures indicate how) that human resources conduct background checks on employees with access to sensitive information. Requiring that information be classified and the process to classify and review information classifications is another example of an administrative control. The organization security awareness program is an administrative control used to make employees cognizant of their security roles and responsibilities. Note that administrative security controls in the form of a policy can be enforced or verified with technical or physical security controls. For instance, security policy may state that computers without antivirus software cannot connect to the network, but a technical control, such as network access control software, will check for antivirus software when a computer tries to attach to the network.
Technical security controls (also called logical controls) are devices, processes, protocols, and other measures used to protect the C.I.A. of sensitive information. Examples include logical access systems, encryptions systems, antivirus systems, firewalls, and intrusion detection systems.
Physical security controls are devices and means to control physical access to sensitive information and to protect the availability of the information. Examples are physical access systems (fences, mantraps, guards), physical intrusion detection systems (motion detector, alarm system), and physical protection systems (sprinklers, backup generator).
Administrative and technical controls depend on proper physical security controls being in place. An administrative policy allowing only authorized employees access to the data center do little good without some kind of physical access control.
From the GIAC.ORG website
NEW QUESTION # 596
You are using an open source packet analyzer called Wireshark and are sifting through the various conversations to see if anything appears to be out of order.
You are observing a UDP conversation between a host and a router. It was a file transfer between the two on port 69. What protocol was used here to conduct the file transfer?
- A. SFTP
- B. TFTP
- C. FTP
- D. SCP
Answer: B
Explanation:
Discussion: TFTP is a curious protocol that doesn't use authentication and is often used to transfer configuration files between an administrator's computer and switch or router.
The admin's computer would have the TFTP server software installed on it and he would SSH into the router and run a command that instructs the router to get its configuration from a TFTP server like this: #copy running-config tftp
The router would request the IP or name of the host from where to get the config and the name of the config file. It would then be copied down into the running-config (RAM) on the router. This is how wireshark could have seen the file transfer.
It is advisable that you use a more secure means to transfer router configuration files because of their sensitive nature. SCP or Secure Copy can be used on most mainstream routing and switching devices.
The following answers are incorrect:
-SFTP: This isn't correct because SFTP uses TCP and is on port 22.
-FTP: This is not the right answer because FTP uses TCP and ordinarily uses ports 20/21.
-SCP: Good guess but SCP doesn't use UDP or port 69 and even if you did 'see' a file transfer between SCP hosts you wouldn't see the contents of the packets because they're encrypted. Sorry. Here's more about SCP.
The following reference(s) was used to create this question:
2013. Official Security+ Curriculum.
TFTP
NEW QUESTION # 597
The security team has been tasked with performing an interface test against a frontend external facing application and needs to verify that all input fields protect against invalid input. Which of the following BEST assists this process?
- A. Instruction set simulation
- B. Sanity testing
- C. Regression testing
- D. Application fuzzing
Answer: D
NEW QUESTION # 598
Which of the following MUST a security professional do in order to quantify the value of a security program to organization management?
- A. Report using metrics.
- B. Rank priorities as high, medium, or low.
- C. Report en employee activities
- D. Communicate compliance obstacles.
Answer: A
Explanation:
Reporting using metrics is the most important thing that a security professional must do in order to quantify the value of a security program to organization management. Metrics are measurable indicators that can be used to evaluate the performance, effectiveness, efficiency, and progress of a security program. Metrics can help the security professional to demonstrate the benefits, costs, risks, and return on investment of the security program, as well as to identify the gaps, weaknesses, and improvement opportunities. Metrics can also help the organization management to understand the security posture, align the security goals with the business objectives, and make informed decisions. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter
1: Security and Risk Management, page 23; [Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 1:
Security and Risk Management, page 85]
NEW QUESTION # 599
What is the MOST important purpose of testing the Disaster Recovery Plan (DRP)?
- A. Identifying the benchmark required for restoration
- B. Determining the Recovery Time Objective (RTO)
- C. Validating the effectiveness of the plan
- D. Evaluating the efficiency of the plan
Answer: C
NEW QUESTION # 600
How many phases are contained in Internet Key Exchange (IKE)?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: D
NEW QUESTION # 601
With data labeling, which of the following MUST be the key decision maker?
- A. Data owner
- B. Data custodian
- C. Information security
- D. Departmental management
Answer: A
NEW QUESTION # 602
Which of the following is an advantage of on-premise Credential Management Systems?
- A. Improved credential interoperability
- B. Lower infrastructure capital costs
- C. Reduced administrative overhead
- D. Control over system configuration
Answer: D
NEW QUESTION # 603
Which of the following division is defined in the TCSEC (Orange Book) as minimal protection?
- A. Division D
- B. Division C
- C. Division B
- D. Division A
Answer: A
Explanation:
Explanation/Reference:
Explanation:
The U.S. Department of Defense developed the Trusted Computer System Evaluation Criteria (TCSEC), which was used to evaluate operating systems, applications, and different products. These evaluation criteria are published in a book known as the Orange Book.
TCSEC provides a classification system that is divided into hierarchical divisions of assurance levels:
A. Verified protection
B. Mandatory protection
C. Discretionary protection
D. Minimal protection
Classification A represents the highest level of assurance, and D represents the lowest level of assurance.
Division D: Minimal Protection: There is only one class in Division D. It is reserved for systems that have been evaluated but fail to meet the criteria and requirements of the higher divisions.
Incorrect Answers:
B: Level C is defined as discretionary protection, not minimal protection.
C: Level B is defined as mandatory protection, not minimal protection.
D: Level A is defined as verified protection, not mandatory minimal.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 392, 395
NEW QUESTION # 604
Multi-Factor Authentication (MFA) is necessary in many systems given common types of password attacks.
Which of the following is a correct list of password attacks?
- A. Masquerading, salami, malware, polymorphism
- B. Zeus, netbus, rabbit, turtle
- C. Brute force, dictionary, phishing, keylogger
- D. Token, biometrics, IDS, DLP
Answer: C
NEW QUESTION # 605
Which of the following is NOT a property of the Rijndael block cipher algorithm?
- A. Maximum key size is 512 bits
- B. Maximum block size is 256 bits
- C. The key sizes must be a multiple of 32 bits
- D. The key size does not have to match the block size
Answer: A
Explanation:
Explanation/Reference:
Explanation:
The maximum key size is 256 bits, not 512 bits.
Rijndael is a block symmetric cipher that was chosen to fulfill the Advanced Encryption Standard. It uses a
128-bit block size and various key lengths (128, 192, 256).
The Rijndael specification is specified with block and key sizes that may be any multiple of 32 bits, both with a minimum of 128 and a maximum of 256 bits.
Incorrect Answers:
A: It is true that the key sizes must be a multiple of 32 bits.
B: It is true that the maximum block size is 256 bits.
D: It is true that the key size does not have to match the block size.
References:
http://searchsecurity.techtarget.com/definition/Rijndael
https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
Krutz, Ronald L. and Russel Dean Vines, The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, New York, 2001, p. 145
NEW QUESTION # 606
What is the BEST reason to include supply chain risks in a corporate risk register?
- A. Risk registers classify and categorize risk and allow risks to be compared to corporate risk appetite.
- B. Risk registers help fund corporate supply chain risk management (SCRM) systems.
- C. Risk registers can be used to illustrate residual risk across the company.
- D. Risk registers allow for the transfer of risk to third parties.
Answer: A
NEW QUESTION # 607
As part of an application penetration testing process, session hijacking can BEST be achieved by which of the following?
- A. Denial of Service (DoS)
- B. Cookie manipulation
- C. Structured Query Language (SQL) injection
- D. Known-plaintext attack
Answer: C
Explanation:
Explanation
Section: Security Assessment and Testing
NEW QUESTION # 608
Which of the following processes has the PRIMARY purpose of identifying outdated software versions, missing patches, and lapsed system updates?
- A. Penetration testing
- B. Life cycle management
- C. Software Development Life Cycle (SDLC)
- D. Vulnerability management
Answer: D
Explanation:
https://resources.infosecinstitute.com/category/certifications-training/cissp/domains/security- operations/vulnerability-and-patch- management/#gref
NEW QUESTION # 609
What is an IP routing table?
- A. A list of station and network addresses with corresponding gateway IP address.
- B. A list of IP addresses and corresponding MAC addresses.
- C. A list of current network interfaces on which IP routing is enabled.
- D. A list of host names and corresponding IP addresses.
Answer: A
Explanation:
A routing table is used when a destination IP address is not located on the current LAN segment. It consists of a list of station and network addresses and a corresponding gateway IP address further along to which a routing equipment should send packets that match that station or network address. A list of IP addresses and corresponding MAC addresses is an ARP table. A DNS is used to match host names and corresponding IP addresses. The last choice is a distracter. Source: STREBE, Matthew and PERKINS, Charles, Firewalls 24seven, Sybex 2000, Chapter 3: TCP/IP from a Security Viewpoint.
NEW QUESTION # 610
Which of the following is the MOST effective strategy to prevent an attacker from disabling a network?
- A. Follow security guidelines to prevent unauthorized network access.
- B. Design networks with the ability to adapt, reconfigure, and fail over.
- C. Implement network segmentation to achieve robustness.
- D. Test business continuity and disaster recovery (DR) plans.
Answer: B
Explanation:
Designing networks with adaptability, reconfigurability, and failover mechanisms enhances their resilience and ensures continuity of services even in the face of attacks or disruptions. This approach makes it more difficult for an attacker to disable the network by introducing redundancy and alternative paths.
NEW QUESTION # 611
A protection mechanism to limit inferencing of information in statistical database queries is:
- A. Specifying a minimum query set size
- B. Specifying a maximum query set size
- C. Specifying a minimum query set size, but prohibiting the querying
of all but one of the records in the database - D. Specifying a maximum query set size, but prohibiting the querying
of all but one of the records in the database
Answer: C
Explanation:
When querying a database for statistical information, individually
identifiable information should be protected. Thus, requiring a
minimum size for the query set (greater than one) offers protection
against gathering information on one individual. However, an attack
may consist of gathering statistics on a query set size M, equal to or
greater than the minimum query set size, and then requesting the
same statistics on a query set size of M + 1. The second query set
would be designed to include the individual whose information is
being sought surreptitiously.
*Thus with answer "Specifying a minimum query set size, but prohibiting the querying of all but one of the records in the database", this type of attack could not take place.
* Answer "Specifying a minimum query set size" is, therefore, incorrect since it leaves open the loophole of the M+1 set size query. Answers "Specifying a maximum query set size" and "Specifying a maximum query set size, but prohibiting the querying of all but one of the records in the database" are incorrect since the critical metric is the minimum query set size and not the maximum size. Obviously, the maximum query set size cannot be set to a value less than the minimum set size.
NEW QUESTION # 612
While investigating a malicious event, only six days of audit logs from the last month were available. What policy should be updated to address this problem?
- A. Recovery
- B. Remediation
- C. Reporting
- D. Retention
Answer: D
Explanation:
The policy that should be updated to address the problem of having only six days of audit logs from the last month available while investigating a malicious event is the retention policy. A retention policy is a policy that defines and specifies the duration and conditions for keeping or storing the records or data of an organization, such as audit logs, backups, or archives. A retention policy should be based on the legal, regulatory, operational, or business requirements of the organization, and should balance the costs and benefits of retaining or disposing the records or data. The problem of having only six days of audit logs from the last month available while investigating a malicious event indicates that the retention policy is inadequate or ineffective, as it does not ensure the availability or accessibility of the audit logs for the investigation purposes.
The retention policy should be updated to address this problem by extending or adjusting the retention period or criteria for the audit logs, and by enforcing or monitoring the compliance with the retention policy. The other options are not the policies that should be updated to address this problem, but rather different or irrelevant policies. A reporting policy is a policy that defines and specifies the procedures and actions for communicating or disclosing the information or incidents of an organization, such as audit results, security breaches, or performance metrics. A reporting policy should be based on the legal, regulatory, operational, or business requirements of the organization, and should ensure the accuracy, timeliness, and completeness of the reporting. A recovery policy is a policy that defines and specifies the objectives and strategies for restoring the normal operations of an organization after a disaster or disruption, such as recovery time objective, recovery point objective, or recovery methods. A recovery policy should be based on the business impact analysis and risk assessment of the organization, and should ensure the continuity, resilience, and availability of the organization. A remediation policy is a policy that defines and specifies the procedures and actions for correcting or improving the security or performance of an organization, such as vulnerability remediation, incident response, or root cause analysis. A remediation policy should be based on the security assessment and audit findings of the organization, and should ensure the effectiveness, efficiency, and compliance of the organization. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 7, p. 376; Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 7, p. 406.
NEW QUESTION # 613
A systems engineer is designing a wide area network (WAN) environment for a new organization. The WAN will connect sites holding information at various levels of sensitivity, from publicly available to highly confidential. The organization requires a high degree of interconnectedness to support existing business processes. What is the BEST design approach to securing this environment?
- A. Layer multiple detective and preventative technologies at the environment perimeter.
- B. Place firewalls around critical devices, isolating them from the rest of the environment.
- C. Use reverse proxies to create a secondary "shadow" environment for critical systems.
- D. Align risk across all interconnected elements to ensure critical threats are detected and handled.
Answer: A
NEW QUESTION # 614
......
All CISSP Dumps and Training Courses: https://actual4test.practicetorrent.com/CISSP-practice-exam-torrent.html