[Jan-2022] Use Real CISSP Dumps Free Sample Questions and Practice Test Engine
Pass ISC CISSP exam - questions - convert Tets Engine to PDF
NEW QUESTION 574
Which of the following media is MOST resistant to EMI interference?
- A. coaxial cable
- B. fiber optic
- C. twisted pair
- D. microwave
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Because fiber-optic cable passes electrically non-conducting photons through a glass medium, it is resistant to Electromagnetic interference (EMI).
Incorrect Answers:
A: Microwaves are vulnerable to Electromagnetic interference (EMI).
C: Twisted pair cables are vulnerable to Electromagnetic interference (EMI).
D: Coaxial cables are vulnerable to Electromagnetic interference (EMI).
NEW QUESTION 575
A group of processes that share access to the same resources is called:
- A. An access control list
- B. A protection domain
- C. An access control triple
- D. A Trusted Computing Base (TCB)
Answer: B
Explanation:
In answer a, an access control list (ACL) is a list denoting which
users have what privileges to a particular resource. Table illustrates
an ACL. The table shows the subjects or users that have access
to the object, FILE X and what privileges they have with respect to
that file.
For answer "An access control triple", an access control triple consists of the user, program, and file with the corresponding access privileges noted for each user.
The TCB, of answer "A Trusted Computing Base (TCB", is defined in the answers as the total combination of protection mechanisms within a computer system. These mechanisms include the firmware, hardware, and software that enforce the system security policy.
image008
NEW QUESTION 576
Which of the following suppresses combustion by disrupting a chemical reaction, by doing so it kills the fire?
- A. soda acid
- B. water
- C. CO2
- D. Halon
Answer: D
Explanation:
It must be noted that Halon is now banned from being produce or manufacture in most country or cities.
Multiple countries have agreed to and signed The Montreal Protocol which disallow production of Halon.
Data Centers that still have Halon loaded within their cylinders will replace it with a safe replacement such as FM200 or Innergen if they ever make use of it.
Halon is a "Clean Agent." The National Fire Protection Association defines, a "Clean Agent" as "an electrically non-conducting, volatile, or gaseous fire extinguishant that does not leave a residue upon evaporation."
Halon is a liquefied, compressed gas that stops the spread of fire by chemically disrupting combustion. Halon 1211 (a liquid streaming agent) and Halon 1301 (a gaseous flooding agent) leave no residue and are remarkably safe for human exposure. Halon is rated for class "B" (flammable liquids) and "C" (electrical fires), but it is also effective on class "A" (common combustibles) fires. Halon 1211 and Halon 1301 are low-toxicity, chemically stable compounds that, as long as they remain contained in cylinders, are easily recyclable.
Halon is an extraordinarily effective fire extinguishing agent, even at low concentrations. According to the Halon Alternative Research Corporation: "Three things must come together at the same time to start a fire. The first ingredient is fuel (anything that can burn), the second is oxygen (normal breathing air is ample) and the last is an ignition source (high heat can cause a fire even without a spark or open flame). Traditionally, to stop a fire you need to remove one side of the triangle - the ignition, the fuel or the oxygen. Halon adds a fourth dimension to fire fighting breaking the chain reaction. It stops the fuel, the ignition and the oxygen from dancing together by chemically reacting with them."
A key benefit of Halon, as a clean agent, is its ability to extinguish fire without the production of residues that could damage the assets being protected. Halon has been used for fire and explosion protection throughout the 20th century, and remains an integral part of the safety plans in many of today's manufacturing, electronic and aviation companies. Halon protects computer and communication rooms throughout the electronics industry; it has numerous military applications on ships, aircraft and tanks and helps ensure safety on all commercial aircraft.
Because Halon is a CFC, production of new Halon ceased in 1994. There is no cost effective means of safely and effectively disposing of the Halon. Therefore, recycling and reusing the existing supply intelligently and responsibly to protect lives and property is the wisest solution.
Sources: http://www.h3rcleanagents.com/support_faq_2.htm and KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, page 335. And AIO v4 pg. 443 has a great chart on how the different extinguishers kill a fire
NEW QUESTION 577
At which OSI layer does SSL reside in?
- A. Transport
- B. Session
- C. Application
- D. Network
Answer: A
Explanation:
The following answers are incorrect: Application - SSL resides in the transport layer.
Session - While SSL does straddle both the session and transport layers, for exam purposes, choose transport.
Network - SSL resides in the transport layer.
The following reference(s) were/was used to create this question: All In One CISSP Exam guide by Shon Harris, Chapter 7, pg 493
NEW QUESTION 578
Which of the following is the BEST technique to facilitate secure software development?
- A. Adhere to secure coding practices for the software application under development.
- B. Conduct penetrating testing for the software application under development.
- C. Develop a threat modeling review for the software application under development.
- D. Perform a code review process for the software application under development.
Answer: A
NEW QUESTION 579
Which of the following statement pertaining to the maintenance of an IT contingency plan is incorrect?
- A. Copies of the plan should be provided to recovery personnel for storage at home and office
- B. The plan should be reviewed at least once a year for accuracy and completeness
- C. The Contingency Planning Coordinator should make sure that every employee gets an up-todate copy of the plan
- D. Strict version control should be maintained
Answer: C
NEW QUESTION 580
What is the most critical characteristic of a biometric identifying system?
- A. Storage requirements
- B. Reliability
- C. Perceived intrusiveness
- D. Accuracy
Answer: D
Explanation:
The principle of biometrics is to use some unique characteristic to identify whether the person is who they say they are. Biometrics works by matching or verifying a person's unique traits with stored data in two categories: physiological characteristics and those that are behavioral. Physical indicators include iris, fingerprint, facial, or hand geometry. Behavior types are usually voiceprints, keystroke dynamics and handwritten signatures. Most biometric technologies require special hardware to convert analog measurements of signatures, voices, or patterns of fingerprints and palm prints, to digital measurement, which computers can read.
The biggest characteristic and problem of biometric implementations today is the accuracy, we must see the level of accuracy before buying a solution, because the technology is not perfect at this time and it can be erroneous sometimes.
NEW QUESTION 581
In what way could Java applets pose a security threat?
- A. Executables from the Internet may attempt an intentional attack when they are downloaded on a client system
- B. Java does not check the bytecode at runtime or provide other safety mechanisms for program
isolation from the client system. - C. Java interpreters do not provide the ability to limit system access that an applet could have on a client system
- D. Their transport can interrupt the secure distribution of World Wide Web pages over the Internet by removing SSL and S-HTTP
Answer: A
Explanation:
"Java Security Java applets use a security scheme that employs a sandbox to limit the applet's access to certain specific areas within the user's system and protects the system from malicious or poorly written applets. The applet is supposed to run only within the sandbox. The sandbox restricts the applet's environment by restricting access to a user's hard drives and system resources. If the applet does not go outside the sandbox, it is considered safe.
However, as with many other things in the computing world, the bad guys have figured out how to escape their confines and restrictions. Programmers have figured out how to write applets that enable the code to access hard drives and resources that are supposed to be protected by the Java security scheme. This code can be malicious in nature and cause destruction and mayhem to the user and her system.
Java employs a sandbox in its security scheme, but if an applet can escape the confines of the sandbox, the system can be easily compromised." Pg 726 Shon Harris: All-In-One CISSP Certification Guide.
NEW QUESTION 582
Qualitative loss resulting from the business interruption does NOT usually include:
- A. Loss of public confidence and credibility
- B. Loss of revenue
- C. Loss of competitive advantage or market share
- D. Loss of market leadership
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Loss of revenue is a quantitative loss, A Qualitative loss. The quantitative impact can be determined by evaluating financial losses such as lost revenue, assets or production units, and salary paid to an idled workforce.
Qualitative impact includes such factors as reputation, goodwill, value of the brand and lost opportunity, among others.
Incorrect Answers:
B: Loss of market share is qualitative loss.
C: Qualitative impact can lead eventually to financial losses over time, for example due to loss of customer confidence.
D: Loss of market leadership is qualitative loss.
References:
http://searchdisasterrecovery.techtarget.com/answer/Debating-quantitative-impact-vs-qualitative-impact
NEW QUESTION 583
Which of the following command line tools can be used in the reconnaisance phase of a network vulnerability assessment?
- A. nbtstat
- B. ipconfig
- C. ifconfig
- D. dig
Answer: D
NEW QUESTION 584
Which access control model is also called Non-Discretionary Access Control (NDAC)?
- A. Label-based access control
- B. Role-based access control
- C. Mandatory access control
- D. Lattice based access control
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Non-discretionary access control is when the system administrator or a single management body within an organization centrally controls access to all resources for everybody on a network. This type of access control can be role based or rule based, as both of these prevents users from making access decisions based upon their own discretion.
Incorrect Answers:
A: Lattice-based Access control is known as a label-based access control, or rule-based access control restriction.
B: Mandatory Access control is based on a security label system
D: Label-based access control uses one or more security labels to control who has read access or write access to individual rows and columns in a table References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 220-228
https://en.wikipedia.org/wiki/Lattice-based_access_control
http://www.drdobbs.com/understanding-label-based-access-control/199201852
NEW QUESTION 585
Which choice is NOT an accurate description of C.I.A.?
- A. I stands for integrity.
- B. C stands for confidentiality.
- C. A stands for authorization.
- D. A stands for availability.
Answer: C
NEW QUESTION 586
A database view is the results of which of the following operations?
- A. Join, Project, and Select.
- B. Join, Project, and Create.
- C. Join and Select.
- D. Join, Insert, and Project.
Answer: A
Explanation:
Explanation/Reference:
Explanation:
SQL offers three classes of operators for creating views: select, project, and join.
The select operator serves to shrink the table vertically by eliminating unwanted rows (tuples).
The project operator serves to shrink the table horizontally by removing unwanted columns (attributes).
Most commercial implementations of SQL do not support a project operation, instead projections are achieved by specifying the columns desired in the output.
The join operator allows the dynamic linking of two tables that share a common column value.
Incorrect Answers:
A: SQL offers three classes of operators for creating views: select, project, and join. However, modern implementations of SQL do not support a project operation, instead projections are achieved by specifying the columns desired in the output. Nevertheless, project is a SQL operator.
B: Insert is a SQL command used to insert data into a table. It is not used to output a view.
C: Create is a SQL command used to create a new database, table, view, or index. However, the data or output of the view requires a select statement to shrink the table vertically by not showing unwanted rows, a project operation that shrinks the table horizontally by not showing unwanted columns, and a join statement when data from more than one table is required.
References:
http://db.grussell.org/section010.html
http://databasemanagement.wikia.com/wiki/Relational_Database_Model
NEW QUESTION 587
What are the primary goals of intrusion detection systems? (Select all that apply.)
- A. Response
- B. Accountability
- C. All of the choices
- D. Availability
Answer: A,B
Explanation:
Although there are many goals associated with security mechanisms in general, there are two overarching goals usually stated for intrusion detection systems. Accountability is the capability to link a given activity or event back to the party responsible for initiating it. This is essential in cases where one wishes to bring criminal charges against an attacker. The goal statement associated with accountability is: "I can deal with security attacks that occur on my systems as long as I know who did it (and where to find them.)" Accountability is difficult in TCP/IP networks, where the protocols allow attackers to forge the identity of source addresses or other source identifiers. It is also extremely difficult to enforce accountability in any system that employs weak identification and authentication mechanisms. Response is the capability to recognize a given activity or event as an attack and then taking action to block or otherwise affect its ultimate goal. The goal statement associated with response is "I don't care who attacks my system as long as I can recognize that the attack is taking place and block it." Note that the requirements of detection are quite different for response than for accountability.
NEW QUESTION 588
Which of the following PRIMARILY contributes to security incidents in web-based applications?
- A. Systems administration and operating systems
- B. Improper stress testing and application interfaces
- C. System incompatibility and patch management
- D. Third-party applications and change controls
Answer: D
NEW QUESTION 589
The IP header contains a protocol field. If this field contains the value of 1, what type of data is contained within the IP datagram?
- A. IGMP.
- B. TCP.
- C. UDP.
- D. ICMP.
Answer: D
Explanation:
Explanation/Reference:
Explanation:
The IP header protocol field value for ICMP is 1.
Incorrect Answers:
A: The IP header protocol field value for TCP is 6, not 1.
C: IP header protocol field value for UDP is 17, not 1.
D: The IP header protocol field value for IGMP is 2, not 1.
References:
Stewart, James M., Ed Tittel, and Mike Chapple, CISSP: Certified Information Systems Security Professional Study Guide, 5th Edition, Sybex, Indianapolis, 2011, p. 122
NEW QUESTION 590
What is NOT an authentication method within IKE and IPsec:
- A. Public Key authentication
- B. certificate based authentication
- C. CHAP
- D. Pre-shared Key
Answer: C
NEW QUESTION 591
Almost all types of detection permit a system's sensitivity to be increased or decreased during an inspection process. To have a valid measure of the system performance:
- A. the FRR is used
- B. the FAR is used
- C. none of the above choices is correct
- D. The CER is used.
Answer: D
Explanation:
"When a biometric system reject an authorized individual, it is called a Type 1 error. When the system accepts impostors who should be rejected, it is called a Type II error. The goal is to obtain low numbers for each type of error. When comparing different biometric systems, many different variables are used, but one of the most important variables is the crossover error rate (CER). This rating is stated in a percentage and represents the point at which the false rejection rate equals the false acceptance rate. This rating is the most important measurement when determining the system's accuracy." Pg 113 Shon Harris: All-in-One CISSP Certification
NEW QUESTION 592
......
Pass Your CISSP Exam Easily - Real CISSP Practice Dump Updated Jan 03, 2022: https://pdfdumps.free4torrent.com/CISSP-valid-dumps-torrent.html