Pass CISSP Exam in First Attempt Guaranteed 2024 Dumps!
CISSP Dumps Full Questions - Exam Study Guide
Introduction of CISSP Exam
The CISSP certification is a globally recognized certification that utilizes a unique CBK (Credential Body of Knowledge) methodology. The CISSP credential is defined as conforming to the requirements of NCEES, the American Society for Testing and Materials (ASTM), and the International Information Systems Security Certification Consortium (ISC). The test will not earn a CISSP valid certification. The new CISSP Exam aims to deliver what the professionals need most the ability to demonstrate that they can apply their knowledge and skills effectively on the jobsite. This exam includes questions from five of the ten domains of knowledge: Access Controls, Application Development Security, Business Continuity and Disaster Recovery Planning, Cryptography, and Risk Management which are also covered in our CISSP Dumps. The CISSP certification exam was updated in May 2012. This guide provides an overview of the CISSP (ISC)2 domains and their respective weighting within the examination to further assist candidates with their studies. The guide also provides guidance on how to prepare for the exam, including how to use the ISC2 CBK (Credential Body of Knowledge) to help develop an individualized study plan. The guide also lists sample questions that can be used as part of a final review prior to taking the exam.
NEW QUESTION # 117
When logging on to a workstation, the log-on process should:
- A. Provide a Help mechanism that provides log-on assistance.
- B. Validate the log-on only after all input data has been supplied.
- C. Place no limits on the time allotted for log-on or on the number of
unsuccessful log-on attempts. - D. Not provide information on the previous successful log-on and on
previous unsuccessful log-on attempts.
Answer: B
Explanation:
This approach is necessary to ensure that all the information required
for a log-on has been submitted and to avoid providing information
that would aid a cracker in trying to gain unauthorized access to the
workstation or network. If a log-on attempt fails, information as to
which part of the requested log-on information was incorrect should
not be supplied to the user.
Answer "Provide a Help mechanism that provides log-on assistance" is incorrect since a
Help utility
would provide help to a cracker trying to gain unauthorized access to
the network.
For answer "Place no limits on the time allotted for log-on or on the number of unsuccessful log-on attempts", maximum and minimum time limits should be placed on the log-on process. Also, the log-on process should limit
the number of unsuccessful log-on attempts and temporarily suspend
the log-on capability if that number is exceeded. One approach is to
progressively increase the time interval allowed between unsuccessful
log-on attempts.
Answer "Not provide information on the previous successful log-on and on previous unsuccessful log-on attempts" is incorrect since providing such information will alert an authorized user if someone has been attempting to gain unauthorized access to the network from the user's workstation.
NEW QUESTION # 118
Which part of an operating system (OS) is responsible for providing security interfaces among the hardware, OS, and other parts of the computing system?
- A. Time separation
- B. Security kernel
- C. Trusted Computing Base (TCB)
- D. Reference monitor
Answer: B
NEW QUESTION # 119
Which of the following services is provided by S-RPC?
- A. Accountability
- B. Integrity
- C. Authentication
- D. Availability
Answer: C
Explanation:
Secure RPC provides authentication services. Secure RPC (Remote Procedure Call) protects remote procedures with an authentication mechanism. The Diffie-Hellman authentication mechanism authenticates both the host and the user who is making a request for a service. The authentication mechanism uses Data Encryption Standard (DES) encryption. Applications that use Secure RPC include NFS and the naming services, NIS and NIS+.
WHAT IS RPC? Remote Procedure Call (RPC) is a protocol that one program can use to request a service from a program located in another computer in a network without having to understand network details. (A procedure call is also sometimes known as a function call or a subroutine call.) RPC uses the client/server model. The requesting program is a client and the service-providing program is the server. Like a regular or local procedure call, an RPC is a synchronous operation requiring the requesting program to be suspended until the results of the remote procedure are returned. However, the use of lightweight processes or threads that share the same address space allows multiple RPCs to be performed concurrently. When program statements that use RPC are compiled into an executable program, a stub is included in the compiled code that acts as the representative of the remote procedure code. When the program is run and the procedure call is issued, the stub receives the request and forwards it to a client runtime program in the local computer. The client runtime program has the knowledge of how to address the remote computer and server application and sends the message across the network that requests the remote procedure. Similarly, the server includes a runtime program and stub that interface with the remote procedure itself. Results are returned the same way. There are several RPC models and implementations. A popular model and implementation is the Open Software Foundation's Distributed Computing Environment (DCE). The Institute of Electrical and Electronics Engineers defines RPC in its ISO Remote Procedure Call Specification, ISO/IEC CD 11578 N6561, ISO/IEC, November 1991. RPC spans the Transport layer and the Application layer in the Open Systems Interconnection (OSI) model of network communication. RPC makes it easier to develop an application that includes multiple programs distributed in a network. All of the other answers are not features of S/RPC.
Reference(s) used for this Question: http://docs.sun.com/app/docs/doc/816-4883/6mb2joane?a=view and http://docs.oracle.com/cd/E23823_01/html/816-4557/auth-2.html and
NEW QUESTION # 120
Which of the following is not a defined layer in the TCP/IP protocol model?
- A. Internet layer
- B. Session layer
- C. Network access layer
- D. Application layer
Answer: B
Explanation:
The TCP/IP reference model is the network model used in the current
Internet architecture. It has its origins back in the 1960's with the grandfather of the
Internet, the ARPANET. This was a research network sponsored by the Department of
Defense in the United States.
The reference model was named after two of its main protocols, TCP (Transmission
Control Protocol) and IP (Internet Protocol). They choose to build a packet-switched network based on a connectionless internet layer. Here is a representation of it:
img1
"The TCP/IP Protocol Model is similar to the OSI model, but it defines only the following four layers instead of seven:
Application Layer. Consists of the applications and processes that use the network.
Host-to-Host Transport Layer. Provides end-to-end data delivery service to the Application
Layer.
Internet Layer. Defines the IP datagram and handles the routing of data across networks.
Network Access or Link Layer. Consists of routines for accessing physical networks and the electrical connection."
Pg 112 Krutz: The CISSP Prep Guide: Gold Edition.
NEW QUESTION # 121
Which of the following encryption types is used in Hash Message Authentication Code (HMAC) for key distribution?
- A. Permanent
- B. Asymmetric
- C. Symmetric
- D. Ephemeral
Answer: C
Explanation:
Symmetric encryption is the type of encryption that is used in Hash Message Authentication Code (HMAC) for key distribution. Encryption is a technique that involves transforming the data or the message into an unreadable or unintelligible form, using a key and an algorithm, and that prevents unauthorized access, modification, or disclosure of the data or the message. Key distribution is a process that involves generating, exchanging, and managing the keys that are used for encryption and decryption, and that ensures that the keys are available and secure for the intended parties. HMAC is a technique that involves generating and appending a code or a tag to the data or the message, using a secret key and a hash function, and that verifies the integrity and the authenticity of the data or the message. Symmetric encryption is a type of encryption that uses the same key for both encryption and decryption, and that requires the key to be shared and agreed upon by both parties before the communication or the transaction. Symmetric encryption is used in HMAC for key distribution, as it provides a fast and efficient way of encrypting and decrypting the data or the message, and of generating and verifying the code or the tag. Symmetric encryption can also reduce the complexity and the overhead of the key distribution process, as it only requires one key to be exchanged and managed between the parties, instead of multiple keys. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 3:
Security Engineering, page 118. CISSP Practice Exam | Boson, Question 17.
NEW QUESTION # 122
Which of the following can be best defined as computing techniques for inseparably embedding unobtrusive marks or labels as bits in digital data and for detecting or extracting the marks later?
- A. Steganography
- B. Digital enveloping
- C. Digital watermarking
- D. Digital signature
Answer: C
Explanation:
RFC 2828 (Internet Security Glossary) defines digital watermarking as computing techniques for inseparably embedding unobtrusive marks or labels as bits in digital data-text, graphics, images, video, or audio#and for detecting or extracting the marks later. The set of embedded bits (the digital watermark) is sometimes hidden, usually imperceptible, and always intended to be unobtrusive. It is used as a measure to protect intellectual property rights. Steganography involves hiding the very existence of a message. A digital signature is a value computed with a cryptographic algorithm and appended to a data object in such a way that any recipient of the data can use the signature to verify the data's origin and integrity. A digital envelope is a combination of encrypted data and its encryption key in an encrypted form that has been prepared for use of the recipient. Source: SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000.
NEW QUESTION # 123
Which of the following statements pertaining to biometrics is FALSE?
- A. False acceptance rate is also known as Type II error.
- B. The crossover error rate is the point at which false rejection rate equals the false acceptance rate.
- C. Biometrics are based on the Type 2 authentication mechanism.
- D. Increased system sensitivity can cause a higher false rejection rate
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Type 2 authentication is based on something you have, like a token. Biometrics for part of Type 3 authentication, which is based on something you are. Something you are refers to an individual's physical traits.
Incorrect Answers:
A, B, C: These options are all TRUE with regards to biometrics.
References:
Conrad, Eric, Seth Misenar, Joshua Feldman, CISSP Study Guide, 2nd Edition, Syngress, Waltham, 2012, pp. 35-37 Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 187-189
NEW QUESTION # 124
In regards to information classification what is the main responsibility of information (data) owner?
- A. periodically check the validity and accuracy of the data
- B. running regular data backups
- C. audit the data users
- D. determining the data sensitivity or classification level
Answer: D
Explanation:
Explanation/Reference:
Explanation:
The data owner (information owner) is usually a member of management who is in charge of a specific business unit, and who is ultimately responsible for the protection and use of a specific subset of information. The data owner has due care responsibilities and thus will be held responsible for any negligent act that results in the corruption or disclosure of the data. The data owner decides upon the classification of the data she is responsible for and alters that classification if the business need arises.
This person is also responsible for ensuring that the necessary security controls are in place, defining security requirements per classification and backup requirements, approving any disclosure activities, ensuring that proper access rights are being used, and defining user access criteria. The data owner approves access requests or may choose to delegate this function to business unit managers.
Incorrect Answers:
B: Running regular data backups is the job of the data custodian, not the data owner.
C: It is not the job of the data owner to audit the data users.
D: Periodically checking the validity and accuracy of the data is the job of the data custodian, not the data owner.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 121
NEW QUESTION # 125
__________ sends out a message to all other computers indicating it is going to send out data.
- A. CSMA/CD
- B. CSMA/CA
- C. SLIP
- D. PPP
- E. CSMA/HB
Answer: B
Explanation:
CSMA/CA sends out a message to all other computers indicating it is going to send out data. CSMA/CA or token ring networking uses this approach to reduce the amount of data collisions.
NEW QUESTION # 126
Which is a benefit of a guard over an automated control?
- A. Guards can use discriminating judgment.
- B. Guards do not need pre-employment screening.
- C. Guards are cheaper.
- D. Guards do not need training.
Answer: A
Explanation:
Guards can use discriminating judgment.
Guards are typically more expensive than automated controls, need
training as to the protection requirements of the specific site, and need to be screened and bonded.
NEW QUESTION # 127
Which of the following answers is directly related to providing High Availability to your users?
- A. Good hiring practices
- B. Updated Antivirus Software
- C. Senior Executive Support
- D. Backup data circuits
Answer: D
Explanation:
When planning for high availability, any critical component of your data network should have some sort of redundancy or backup plan in case it does fail.
Usually this involves things like backup data circuits, fault tolerant systems and otherwise redundant technology across the board.
This can include items like these:
-RAID array disks on servers so that if any single drive fails the server remains available.
-
Backup network connections. Many internet services providers provide these for a fee.
-
Backup power for all systems and circuits.
-Fire suppression and evacuation plans.
-A data backup practice to backup and restore data while storing backups offsite in a safe, remote location.
Also critical to high availability is a well-planned and tested disaster recovery plan. You can either
develop one, find one free online or pay a contract agency to develop one for you.
The lines get a little blurry between fault tolerance and high availability because one is the direct
result of the other but the questions on the exam should be pretty clear.
The following answers are incorrect:
-Good hiring practices: High Availability doesn't really involve good hiring practices but when you higher good technicians you availability would definitely improve.
-Updated Antivirus Software: This isn't directly related to high availability, although it's a critical part of defense in depth.
-Senior Executive Support: While this is important for funding equipment for high availability it isn't directly related to providing the high availability.
The following reference(s) was used to create this question: 2013. Official Security+ Curriculum.
NEW QUESTION # 128
What category of water sprinkler system is currently the most recommended water system for a computer room?
- A. Dry Pipe sprinkler system
- B. Deluge sprinkler system
- C. Wet Pipe sprinkler system
- D. Pre-action sprinkler system
Answer: D
NEW QUESTION # 129
Place in order, from BEST (1) to WORST (4), the following methods to reduce the risk of data remanence on magnetic media.
Answer:
Explanation:
NEW QUESTION # 130
What is the MAIN feature that onion routing networks offer?
- A. Resilience
- B. Traceability
- C. Non-repudiation
- D. Anonymity
Answer: D
Explanation:
The main feature that onion routing networks offer is anonymity. Anonymity is the state of being unknown or unidentifiable by hiding or masking the identity or the location of the sender or the receiver of a communication. Onion routing is a technique that enables anonymous communication over a network, such as the internet, by encrypting and routing the messages through multiple layers of intermediate nodes, called onion routers. Onion routing can protect the privacy and security of the users or the data, and can prevent censorship, surveillance, or tracking by third parties. Non-repudiation, traceability, and resilience are not the main features that onion routing networks offer, as they are related to the proof, tracking, or recovery of the communication, not the anonymity of the communication. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 4, Communication and Network Security, page 467. Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 4, Communication and Network Security, page 483.
NEW QUESTION # 131
Which of the following is the BEST way to determine the success of a patch management process?
- A. Auditing and assessment
- B. Analysis and impact assessment
- C. Change management
- D. Configuration management (CM)
Answer: A
Explanation:
The best way to determine the success of a patch management process is to perform auditing and assessment.
Auditing and assessment are the activities that involve evaluating and measuring the effectiveness and compliance of the patch management process, and identifying and reporting any gaps, issues, or improvements. Auditing and assessment can help to verify that the patch management process is aligned with the security policies and standards, and that it meets the security requirements and expectations of the organization and the stakeholders. Auditing and assessment can also help to ensure that the patch management process is consistent, efficient, and reliable, and that it reduces the security risks and vulnerabilities of the system or network12. References: CISSP CBK, Fifth Edition, Chapter 6, page 569; CISSP Practice Exam - FREE 20 Questions and Answers, Question 20.
NEW QUESTION # 132
Functional security testing is MOST critical during which phase of the system development life cycle (SDLC)?
- A. Implementation
- B. Initiation
- C. Acquisition / Development
- D. Operations / Maintenance
Answer: A
NEW QUESTION # 133
The Information Technology Security Evaluation Criteria (ITSEC) was written to address which of the following that the Orange Book did not address?
- A. none of the above
- B. integrity and availability
- C. confidentiality and availability
- D. integrity and confidentiality
Answer: B
Explanation:
"ITSECTCSEC (Orange Book) E0D F1+E1C1 F2+E2C2 F3+E3B1 F4+E4B2 F5+E5B3 F5+E6A1 F6=Systems that provide high integrity F7=Systems that provide high availability F8=Systems that provide data integrity during communication F9=Systems that provide high confidentiality F10=Networks with high demands on confidentiality and integrity"
Pg. 230 Shon Harris: All-in-One CISSP Certification
NEW QUESTION # 134
An organization plan on purchasing a custom software product developed by a small vendor to support its business model. Which unique consideration should be made part of the contractual agreement potential long-term risks associated with creating this dependency?
- A. Right to request an independent review of the software source code
- B. A source code escrow clause
- C. Due diligence form requesting statements of compliance with security requirements
- D. Access to the technical documentation
Answer: B
Explanation:
A source code escrow clause is a unique consideration that should be made part of the contractual agreement when purchasing a custom software product developed by a small vendor to support the business model. A source code escrow clause is a provision that requires the vendor to deposit the source code of the software product with a trusted third party, who will release it to the customer under certain conditions, such as the vendor's bankruptcy, insolvency, or failure to provide maintenance or support. A source code escrow clause can help to mitigate the potential long-term risks associated with creating a dependency on a small vendor, such as losing access to the software product, being unable to fix bugs or vulnerabilities, or being unable to modify or update the software product. A right to request an independent review of the software source code, a due diligence form requesting statements of compliance with security requirements, and an access to the technical documentation are not unique considerations, but common ones that should be included in any software acquisition contract. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 1: Security and Risk Management, page 65; Official (ISC)2 Guide to the CISSP CBK, Fifth Edition, Chapter 1: Security and Risk Management, page 57.
NEW QUESTION # 135
......
The CISSP certification is highly sought after by employers and can significantly enhance the career prospects of professionals in the field of information security. It is recognized by government agencies, corporations, and organizations worldwide as a standard for measuring an individual's knowledge and skills in the field of information security. Achieving CISSP certification requires hard work, dedication, and a commitment to ongoing professional development.
ISC Certification Free Certification Exam Material from FreePdfDump with 1483 Questions: https://www.freepdfdump.top/CISSP-valid-torrent.html
Use Real CISSP - 100% Cover Real Exam Questions: https://drive.google.com/open?id=1bjsK5P9_GhKQa1f8DzPLN5bTPZQXfO8n
