• Shuffle
    Toggle On
    Toggle Off
  • Alphabetize
    Toggle On
    Toggle Off
  • Front First
    Toggle On
    Toggle Off
  • Both Sides
    Toggle On
    Toggle Off
  • Read
    Toggle On
    Toggle Off
Reading...
Front

Card Range To Study

through

image

Play button

image

Play button

image

Progress

1/136

Click to flip

Use LEFT and RIGHT arrow keys to navigate between flashcards;

Use UP and DOWN arrow keys to flip the card;

H to show hint;

A reads text to speech;

136 Cards in this Set

  • Front
  • Back
All of the following are basic components of a security policy EXCEPT the
A. definition of the issue and statement of relevant terms.
B. statement of roles and responsibilities
C. statement of applicability and compliance requirements.
D. statement of performance of characteristics and requirements.
Answer: D statment of performance of characteriscs and requirments.
Explanation:
Policies are considered the first and highest level of documentation, from which the lower level
elements of standards, procedures, and guidelines flow. This order , however, does not mean that
policies are more important than the lower elements. These higher-level policies, which are the
more general policies and statements, should be created first in the process for strategic reasons,
and then the more tactical elements can follow . -Ronald Krutz The CISSP PREP Guide (gold
A security policy would include all of the following EXCEPT
A. Background
B. Scope statement
C. Audit requirements
D. Enforcemen
Answer: B Scope statement
Which one of the following is an important characteristic of an information security policy?
A. Identifies major functional areas of information.
B. Quantifies the effect of the loss of the information.
C. Requires the identification of information owners.
D. Lists applications that support the business function.
Answer: A Identifies major functional areas of information.


Explanation:
Information security policies area high-level plans that describe the goals of the procedures.
Policies are not guidelines or standards, nor are they procedures or controls. Policies describe
security in general terms, not specifics. They provide the blueprints for an overall security program
just as a specification defines your next product - Roberta Bragg CISSP Certification Training
Guide (que) pg 206
Ensuring the integrity of business information is the PRIMARY concern of
A. Encryption Security
B. Procedural Security.
C. Logical Security
D. On-line Security
Answer: B Procedural Security.


Explanation:
Procedures are looked at as the lowest level in the policy chain because they are closest to the
computers and provide detailed steps for configuration and installation issues. They provide the
steps to actually implement the statements in the policies, standards, and guidelines...Security
procedures, standards, measures, practices, and policies cover a number of different subject
areas. - Shon Harris All-in-one CISSP Certification Guide pg 44-45
Which of the following would be the first step in establishing an information security program?
A. ) Adoption of a corporate information security policy statement
B. ) Development and implementation of an information security standards manual
C. ) Development of a security awareness-training program
D. ) Purchase of security access control software
Answer: A

Adoption of a corporate information security policy statement
QUESTION NO: 6
Which of the following department managers would be best suited to oversee the development of
an information security policy?
A. ) Information Systems
B. ) Human Resources
C. ) Business operations
D. ) Security administration
Answer: C Business operations
QUESTION NO: 7
What is the function of a corporate information security policy?
A. Issue corporate standard to be used when addressing specific security problems.
B. Issue guidelines in selecting equipment, configuration, design, and secure operations.
C. Define the specific assets to be protected and identify the specific tasks which must be
completed to secure them.
D. Define the main security objectives which must be achieved and the security framework to meet
business objectives.
Answer: D Define the main security objectives which must be achieved and the security framework to meet
business objectives.



Explanation:
Information security policies are high-level plans that describe the goals of the procedures or
controls. Policies describe security in general, not specifics. They provide the blueprint fro an
overall security program just as a specification defines your next product. - Roberta Bragg CISSP
Certification Training Guide (que) pg 587
Why must senior management endorse a security policy?
A. So that they will accept ownership for security within the organization.
B. So that employees will follow the policy directives.
C. So that external bodies will recognize the organizations commitment to security.
D. So that they can be held legally accountable.
Answer: A So that they will accept ownership for security within the organization.


Explanation:
This really does not a reference as it should be known. Upper management is legally accountable
(up to 290 million fine). External organizations answer is not really to pertinent (however it stated
that other organizations will respect a BCP and disaster recover plan). Employees need to be
bound to the policy regardless of who signs it but it gives validity. Ownership is the correct answer
in this statement. However, here is a reference. "Fundamentally important to any security
program's success us the senior management's high-level statement of commitment to the
information security policy process and a senior management's understanding of how important
security controls and protections are to the enterprise's continuity. Senior management must be
aware of the importance of security implementation to preserve the organization's viability (and for
their own 'due care' protection) and must publicly support that process throughout the enterprise."
-Ronald Krutz The CISSP PREP Guide (gold edition) pg 13
In which one of the following documents is the assignment of individual roles and responsibilities
MOST appropriately defined?
A. Security policy
B. Enforcement guidelines
C. Acceptable use policy
D. Program manual
A: Acceptable use policy


An acceptable use policy is a document that the employee signs in which the expectations, roles
and responsibilities are outlined.
Issue -specific policies address specific security issues that management feels need more detailed
explanation and attention to make sure a comprehensive structure is built and all employees
understand how they are to comply to these security issues. - Shon Harris All-in-one CISSP
Certification Guide pg 62
Which of the following defines the intent of a system security policy?
A. A definition of the particular settings that have been determined to provide optimum security.
B. A brief, high-level statement defining what is and is not permitted during the operation of the
system.
C. A definition of those items that must be excluded on the system.
D. A listing of tools and applications that will be used to protect the system.
Answer: A

Explanation:
"A system-specific policy presents the management's decisions that are closer to the actual
computers, networks, applications, and data. This type of policy can provide an approved software
list, which contains a list of applications that can be installed on individual workstations. This policy
can describe how databases are to be protected, how computers are to be locked down, and how
firewall, intrusion diction systems, and scanners are to be employed." Pg 93 Shon Harris CISSP
All-In-One Certification Exam Guide
When developing an information security policy, what is the FIRST step that should be taken?
A. Obtain copies of mandatory regulations.
B. Gain management approval.
C. Seek acceptance from other departments.
D. Ensure policy is compliant with current working practices
B. Gain management approval
Which one of the following should NOT be contained within a computer policy?
A. Definition of management expectations.
B. Responsibilities of individuals and groups for protected information.
C. Statement of senior executive support.
D. Definition of legal and regulatory controls
B. Responsibilities of individuals and groups for protected information.
Which one of the following is NOT a fundamental component of a Regulatory Security Policy?
A. What is to be done.
B. When it is to be done.
C. Who is to do it.
D. Why is it to be done
C. Who is to do it.


Regulatory Security policies are mandated to the organization but it up to them to implement it.
"Regulatory - This policy is written to ensure that the organization is following standards set by a
specific industry and is regulated by law. The policy type is detailed in nature and specific to a type
of industry. This is used in financial institutions, health care facilities, and public utilities." - Shon
Harris All-in-one CISSP Certification Guide pg 93-94
Which one of the following statements describes management controls that are instituted to
implement a security policy?
A. They prevent users from accessing any control function.
B. They eliminate the need for most auditing functions.
C. They may be administrative, procedural, or technical.
D. They are generally inexpensive to implement
C. They may be administrative, procedural, or technical


Explanation:
Administrative, physical, and technical controls should be utilized to achieve the management's
directives. - Shon Harris All-in-one CISSP Certification Guide pg 60
Which must bear the primary responsibility for determining the level of protection needed for
information systems resources?
A. ) IS security specialists
B. ) Senior Management
C. ) Seniors security analysts
D. ) system auditors
B. ) Senior Management
Which of the following choices is NOT part of a security policy?
A. ) definition of overall steps of information security and the importance of security
B. ) statement of management intend, supporting the goals and principles of information security
C. ) definition of general and specific responsibilities for information security management
D. ) description of specific technologies used in the field of information security
D. ) description of specific technologies used in the field of information security
In an organization, an Information Technology security function should
A. ) Be a function within the information systems functions of an organization
B. ) Report directly to a specialized business unit such as legal, corporate security or insurance
C. ) Be lead by a Chief Security Officer and report directly to the CEO
D. ) Be independent but report to the Information Systems function
C. ) Be lead by a Chief Security Officer and report directly to the CEO
Which of the following embodies all the detailed actions that personnel are required to follow?
A. ) Standards
B. ) Guidelines
C. ) Procedures
D. ) Baselines
C. ) Procedures
What are the three fundamental principles of security?
A. ) Accountability, confidentiality, and integrity
B. ) Confidentiality, integrity, and availability
C. ) Integrity, availability, and accountability
D. ) Availability, accountability, and confidentiality
B. ) Confidentiality, integrity, and availability
Which of the following prevents, detects, and corrects errors so that the integrity, availability, and
confidentiality of transactions over networks may be maintained?
A. ) Communications security management and technique
B. ) Networks security management and techniques
C. ) Clients security management and techniques
D. ) Servers security management and techniques
Communications security management and techniques
Most computer attacks result in violation of which of the following security properties?
A. Availability
B. Confidentiality
C. Integrity and control
D. All of the choices.
All of the choices.



Most computer attacks only corrupt a system's security in very specific ways. For
example, certain attacks may enable a hacker to read specific files but don't allow
alteration of any system components. Another attack may allow a hacker to shut down
certain system components but doesn't allow access to any files. Despite the varied
capabilities of computer attacks, they usually result in violation of only four
different security properties: availability, confidentiality, integrity, and control.
Which of the following are objectives of an information systems security program?
A. Threats, vulnerabilities, and risks
B. Security, information value, and threats
C. Integrity, confidentiality, and availability.
D. Authenticity, vulnerabilities, and costs.
C. Integrity, confidentiality, and availability.


There are several small and large objectives of a security program, but the main three principles in
all programs are confidentiality, integrity, and availability. These are referred to as the CIA triad. -
Shon Harris All-in-one CISSP Certification Guide pg 62
An area of the Telecommunications and Network Security domain that directly affects the
Information Systems Security tenet of Availability can be defined as:
A. ) Netware availability
B. ) Network availability
C. ) Network acceptability
D. ) Network accountability
B. ) Network availability
The Structures, transmission methods, transport formats, and security measures that are used to
provide integrity, availability, and authentication, and confidentiality for transmissions over private
and public communications networks and media includes:

A. ) The Telecommunications and Network Security domain
B. ) The Telecommunications and Netware Security domain
C. ) The Technical communications and Network Security domain
D. ) The Telnet and Security domain
The Telecommunications and Network Security domain


The Telecommunications, Network, and Internet Security Domain encompasses the structures,
transmission methods, transport formats, and security measures used to provide integrity,
availability, authentication, and confidentiality for transmissions over private and public
communications networks and media." Pg 515 Hansche: Official (ISC)2 Guide to the CISSP Exam
Which one of the following is the MOST crucial link in the computer security chain?
A. Access controls
B. People
C. Management
D. Awareness programs
C. Management
The security planning process must define how security will be managed, who will be responsible,
and
A. Who practices are reasonable and prudent for the enterprise.
B. Who will work in the security department.
C. What impact security will have on the intrinsic value of data.
D. How security measures will be tested for effectiveness.
D. How security measures will be tested for effectiveness
Information security is the protection of data. Information will be protected mainly based on:
A. Its sensitivity to the company.
B. Its confidentiality.
C. Its value.
D. All of the choices.
. All of the choices.

Information security is the protection of data against accidental or malicious
disclosure, modification, or destruction. Information will be protected based on its
value, confidentiality, and/or sensitivity to the company, and the risk of loss or
compromise. At a minimum, information will be update-protected so that only authorized
individuals can modify or erase the information.
Organizations develop change control procedures to ensure that
A. All changes are authorized, tested, and recorded.
B. Changes are controlled by the Policy Control Board (PCB).
C. All changes are requested, scheduled, and completed on time.
D. Management is advised of changes made to systems.
All changes are authorized, tested, and recorded.

Change Control: Changes must be authorized, tested, and recorded. Changed systems may
require re-certification and re-accreditation." Pg 699 Shon Harris: All-in-One CISSP Certification
Within the organizational environment, the security function should report to an organizational
level that
A. Has information technology oversight.
B. Has autonomy from other levels.
C. Is an external operation.
D. Provides the internal audit function.
Has autonomy from other levels
What is the MAIN purpose of a change control/management system?

A. Notify all interested parties of the completion of the change.
B. Ensure that the change meets user specifications.
C. Document the change for audit and management review.
D. Ensure the orderly processing of a change request.
C. Document the change for audit and management review
Which of the following is most relevant to determining the maximum effective cost of access
control?
A. ) the value of information that is protected
B. ) management's perceptions regarding data importance
C. ) budget planning related to base versus incremental spending.
D. ) the cost to replace lost data
A. ) the value of information that is protected
Which one of the following is the MAIN goal of a security awareness program when addressing
senior management?
A. Provide a vehicle for communicating security procedures.
B. Provide a clear understanding of potential risk and exposure.
C. Provide a forum for disclosing exposure and risk analysis.
D. Provide a forum to communicate user responsibilities
B. Provide a clear understanding of potential risk and exposure

When the Security Officer is addressing Senior Management, the focus would not be on user
responsibilities, it would be on making sure the Senior Management have a clear understanding of
the risk and potential liability is

Not D: Item D would be correct in a situation where Senior Management is addressing
organizational staff.
In developing a security awareness program, it is MOST important to
A. Understand the corporate culture and how it will affect security.
B. Understand employees preferences for information security.
C. Know what security awareness products are available.
D. Identify weakness in line management support.
A. Understand the corporate culture and how it will affect security.

Explanation:
The controls and procedures of a security program should reflect the nature of the data being
processed...These different types of companies would also have very different cultures. For a
security awareness program to be effective, these considerations must be understood and the
program should be developed in a fashion that makes sense per environment - Shon Harris All-inone
CISSP Certification Guide pg 109
Which of the following would be best suited to provide information during a review of the controls
over the process of defining IT service levels?
A. ) Systems programmer
B. ) Legal stuff
C. ) Business unit manager
D. ) Programmer
C. ) Business unit manager
Which of the following best explains why computerized information systems frequently fail to meet
the needs of users?
A. ) Inadequate quality assurance (QA) tools
B. ) Constantly changing user needs
C. ) Inadequate user participation in defining the system's requirements
D. ) Inadequate project management
C. ) Inadequate user participation in defining the system's requirements
Which of the following is not a compensating measure for access violations?
A. ) Backups
B. ) Business continuity planning
C. ) Insurance
D. ) Security awareness
D. ) Security awareness
Risk analysis is MOST useful when applied during which phase of the system development
process?
A. ) Project identification
B. ) Requirements definition
C. ) System construction
D. ) Implementation planning
A. ) Project identification
Which one of the following is not one of the outcomes of a vulnerability analysis?
A. ) Quantative loss assessment
B. ) Qualitative loss assessment
C. ) Formal approval of BCP scope and initiation document
D. ) Defining critical support areas
C. ) Formal approval of BCP scope and initiation document
Which of the following is not a part of risk analysis?

A. ) Identify risks
B. ) Quantify the impact of potential threats
C. ) Provide an economic balance between the impact of the risk and the cost of the associated
countermeasures
D. ) Choose the best countermeasure
D. ) Choose the best countermeasure
A new worm has been released on the Internet. After investigation, you have not been able to
determine if you are at risk of exposure. Management is concerned as they have heard that a
number of their counterparts are being affected by the worm. How could you determine if you are
at risk?
A. Evaluate evolving environment.
B. Contact your anti-virus vendor.
C. Discuss threat with a peer in another organization.
D. Wait for notification from an anti-virus vendor.
B. Contact your anti-virus vendor.
When conducting a risk assessment, which one of the following is NOT an acceptable social
engineering practice?
A. Shoulder surfing
B. Misrepresentation
C. Subversion
D. Dumpster diving
A. Shoulder surfing

Shoulder Surfing: Attackers can thwart confidentiality mechanisms by network monitoring,
shoulder surfing, stealing password files, and social engineering. These topics will be address
more in-depth in later chapters, but shoulder surfing is when a person looks over another person's
shoulder and watches keystrokes or data as it appears on the screen. Social engineering is
tricking another person into sharing confidential information by posing as an authorized individual
to that information. Shon Harris: CISSP Certification pg. 63. Shoulder surfing is not social
engineering.
ISC CISSP: Practice Exam
"
Which one of the following risk analysis terms characterizes the absence or weakness of a riskreducing
safegaurd?
A. Threat
B. Probability
C. Vulnerability
D. Loss expectancy
C. Vulnerability

A weakness in system security procedures, system design, implementation, internal controls, and
so on that could be exploited to violate system security policy. - Ronald Krutz The CISSP PREP
Guide (gold edition) pg 927
Risk is commonly expressed as a function of the
A. Systems vulnerabilities and the cost to mitigate.
B. Types of countermeasures needed and the system's vulnerabilities.
C. Likelihood that the harm will occur and its potential impact.
D. Computer system-related assets and their costs.
C. Likelihood that the harm will occur and its potential impact.

The likelihood of a threat agent taking advantage of a vulnerability. A risk is the loss potential, or
probability, that a threat will exploit a vulnerability. - Shon Harris All-in-one CISSP Certification
Guide pg 937
How should a risk be handled when the cost of the countermeasures outweighs the cost of the
risk?
A. ) Reject the risk
B. ) Perform another risk analysis
C. ) Accept the risk
D. ) Reduce the risk
C. ) Accept the risk
Which of the following is an advantage of a qualitative over quantitative risk analysis?
A. ) It prioritizes the risks and identifies areas for immediate improvement in addressing the
vulnerabilities.
C.) It provides specific quantifiable measurements of the magnitude of the impacts
D.) It makes cost-benefit analysis of recommended controls easier
A. ) It prioritizes the risks and identifies areas for immediate improvement in addressing the
vulnerabilities.
Which of the following statements pertaining to ethical hacking is incorrect?
A. ) An organization should use ethical hackers who do not sell auditing, consulting, hardware,
software, firewall, hosting, and/or networking services
B. ) Testing should be done remotely
C. ) Ethical hacking should not involve writing to or modifying the target systems
D. ) Ethical hackers should
Ethical hacking should not involve writing to or modifying the target systems
Why would an information security policy require that communications test equipment be
controlled?
A. ) The equipment is susceptible to damage
B. ) The equipment can be used to browse information passing on a network
C. ) The equipment must always be available for replacement if necessary
D. ) The equipment can be used to reconfigure the network multiplexers
B. ) The equipment can be used to browse information passing on a network
Management can expect penetration tests to provide all of the following EXCEPT
A. identification of security flaws
B. demonstration of the effects of the flaws
C. a method to correct the security flaws.
D. verification of the levels of existing infiltration resistance
C. a method to correct the security flaws.



Not B: It is not the objective of the pen tester to supply a method on how to correct the flaws. In
fact management may decide to accept the risk and not repair the flaw. They may be able to
demonstrate the effects of a flaw - especially if they manage to clobber a system!
Penetration testing is a set of procedures designed to test and possibly bypass security controls of
a system. Its goal is to measure an organization's resistance to an attack and to uncover any
weaknesses within the environment...The result of a penetration test is a report given to
management describing the list of vulnerabilities that were identified and the severity of those
vulnerabilities. From here, it is up to management to determine how the vulnerabilities are dealt
with and what countermeasures are implemented. - Shon Harris All-in-one CISSP Certif
Which one of the following is a characteristic of a penetration testing project?
A. The project is open-ended until all known vulnerabilities are identified.
B. The project schedule is plotted to produce a critical path.
C. The project tasks are to break into a targeted system.
D. The project plan is reviewed with the target audience.
C. The project tasks are to break into a targeted system.



"One common method to test the strength of your security measures is to perform penetration
testing. Penetration testing is a vigorous attempt to break into a protected network using any
means necessary." Pg 430 Tittel: CISSP Study Guide
Which one of the following is the PRIMARY objective of penetration testing?
A. Assessment
B. Correction
C. Detection
D. Protection
C. Detection
Open box testing, in the Flaw Hypothesis Methodology of Penetration Testing applies to the
analysis of
A. Routers and firewalls
B. Host-based IDS systems
C. Network-based IDS systems
D. General purpose operating systems
D. General purpose operating systems


Flaw Hypothesis Methodology - A system analysis and penetration technique where specifications
and documentation for the system are analyzed and then flaws in the system are hypothesized.
The list of hypothesized flaws is then prioritized on the basis of the estimated probability that a
flaw actually exists and, assuming a flaw does exist, on the ease of exploiting it and on the extent
of control or compromise it would provide. The prioritized list is used to direct the actual testing of
the system. http://www.kernel.org/pub/linux/libs/security/Orange-Linux/refs/Orange/Orange0-
5.html
What is the FIRST step that should be considered in a penetration test?
A. The approval of change control management.
B. The development of a detailed test plan.
C. The formulation of specific management objectives.
D. The communication process among team members.
C. The formulation of specific management objectives.

The type of penetration test depends on the organization, its security objectives, and the
management's goals. - Shon Harris All-in-one CISSP Certification Guide pg 838
Penetration testing will typically include
A. Generally accepted auditing practices.
B. Review of Public Key Infrastructure (PKI) digital certificate, and encryption.
C. Social engineering, configuration review, and vulnerability assessment.
D. Computer Emergency Response Team (CERT) procedures.
C. Social engineering, configuration review, and vulnerability assessment.
Which of the following is not a valid reason to use external penetration service firms rather than
corporate resources?
A. ) They are more cost-effective
B. ) They offer a lack of corporate bias
C. ) They use highly talented ex-hackers
D. ) They insure a more complete reporting
C. ) They use highly talented ex-hackers
Annualized Loss Expectancy (ALE) value is derived from an algorithm of the product of annual
rate of occurrence and
D. Single loss expectancy.
If your property insurance has Actual Cost Evaluation (ACV) clause your damaged property will be
compensated:
A. ) Based on the value of the item on the date of loss
B. ) Based on new item for old regardless of condition of lost item
C. ) Based on value of item one month before loss
D. ) Based on value of item on the date of loss plus 10 percent
D. ) Based on value of item on the date of loss plus 10 percent
How is Annualized Loss Expectancy (ALE) derived from a threat?
A. ) ARO x (SLE - EF)
B. ) SLE x ARO
C. ) SLE/EF
D. ) AV x EF
B. ) SLE x ARO

"SLE x annualized rate of occurrence (ARO) = ALE" pg 70 Shon Harris: All-in-One CISSP
Certification
Qualitative loss resulting from the business interruption does not include
A. ) Loss of revenue
B. ) Loss of competitive advantage or market share
C. ) Loss of public confidence and credibility
D. ) Public embarrassment
A. ) Loss of revenue
"Another method of risk analysis is qualitative, which does not assign numbers and monetary
valu8es to components and losses." Pg 72 Shon Harris: All-in-One CISSP Certification
Which risk management methodology uses the exposure factor multiplied by the asset value to
determine its outcome?
A. Annualized Loss Expectancy
B. Single Loss Expectancy
C. Annualized Rate of Occurrence
D. Information Risk Management
B. Single Loss Expectancy


Single Loss Expectancy (SLE) AN SLE is the dollar figure that is assigned to a single event. It
represents an organization's loss from a single threat and is derived from the following formula:
Asset Value ($) X Exposure Factor (EF) = SLE -Ronald Krutz The CISSP PREP Guide (gold
edition) pg 18
Valuable paper insurance coverage does not cover damage to which of the following?
A. ) Inscribed, printed and written documents
B. ) Manuscripts
C. ) Records
D. ) Money and Securities
D. ) Money and Securities
What is the window of time for recovery of information processing capabilities based on?
A. ) Quality of the data to be processed
B. ) Nature of the disaster
C. ) Criticality of the operations affected
D. ) Applications that are mainframe based
C. ) Criticality of the operations affected
What is the Maximum Tolerable Downtime (MTD):
A. ) Maximum elapsed time required to complete recovery of application data
B. ) Minimum elapsed time required to complete recovery of application data
C. ) Maximum elapsed time required to move back to primary site a major disruption
D. ) It is maximum delay businesses that can tolerate and still remain viable
D. ) It is maximum delay businesses that can tolerate and still remain viable
A "critical application" is one that MUST
A. Remain operational for the organization to survive.
B. Be subject to continual program maintenance.
C. Undergo continual risk assessments.
D. Be constantly monitored by operations management
A. Remain operational for the organization to survive.
Which of the following questions is less likely to help in assessing physical and environmental
protection?
A. ) Are entry codes changed periodically?
B. ) Are appropriate fire suppression and prevention devices installed and working?
C. ) Are there processes to ensure that unauthorized individuals cannot read, copy, alter, or steal
printed or electronic information?
D. ) Is physical access to data transmission lines controlled?
C. ) Are there processes to ensure that unauthorized individuals cannot read, copy, alter, or steal
A. Limit the number of classifications.
B. Generate internal labels on diskettes.
C. Declassify information when appropriate.
D. Establish information ownership
C. Declassify information when appropriate
The purpose of information classification is to
A. Assign access controls.
B. Apply different protective measures.
C. Define the parameters required for security labels.
D. Ensure separation of duties.
C. Define the parameters required for security labels.
What is the main responsibility of the information owner?
A. ) making the determination to decide what level of classification the information requires
B. ) running regular backups
C. ) audit the users when they require access to the information
D. ) periodically checking the validity and accuracy for all data in the information system
A. ) making the determination to decide what level of classification the information requires
What process determines who is trusted for a given purpose?
A. Identification
B. Authorization
C. Authentication
D. Accounting
B. Authorization

Authorization determines who is trusted for a given purpose. More precisely, it
determines whether a particular principal, who has been authenticated as the source of
a request to do something, is trusted for that operation. Authorization may also
include controls on the time at which something can be done (e.g. only during working
hours) or the computer terminal from which it can be requested (e.g. only the one on
the system administrator desk).
To ensure least privilege requires that __________ is identified.
A. what the users privilege owns
B. what the users job is
C. what the users cost is
D. what the users group is
B. what the users job is



Ensuring least privilege requires identifying what the user's job is, determining the
minimum set of privileges required to perform that job, and restricting the user to a
domain with those privileges and nothing more. By denying to subjects transactions that
are not necessary for the performance of their duties, those denied privileges couldn't
be used to circumvent the organizational security policy. Although the concept of least
privilege currently exists within the context of the TCSEC, requirements restrict those
privileges of the system administrator. Through the use of RBAC, enforced minimum
privileges for general system users can be easily achieved.
The concept of least privilege currently exists within the context of:
A. ISO
B. TCSEC
C. OSI
D. IEFT
B. TCSEC


Ensuring least privilege requires identifying what the user's job is, determining the
minimum set of privileges required to perform that job, and restricting the user to a
domain with those privileges and nothing more. By denying to subjects transactions that
are not necessary for the performance of their duties, those denied privileges couldn't
be used to circumvent the organizational security policy. Although the concept of least
privilege currently exists within the context of the TCSEC, requirements restrict those
privileges of the system administrator. Through the use of RBAC, enforced minimum
privileges for general system users can be easily achieved.
Which of the following rules is less likely to support the concept of least privilege?
A. ) The number of administrative accounts should be kept to a minimum
B. ) Administrators should use regular accounts when performing routing operations like reading
mail
C. ) Permissions on tools that are likely to be used by hackers should be as restrictive as possible
D. ) Only data to and from critical systems and applications should be allowed through the firewall
D. ) Only data to and from critical systems and applications should be allowed through the firewall
Which level of "least privilege" enables operators the right to modify data directly in it's original
location, in addition to data copied from the original location?
A. ) Access Change
B. ) Read/Write
C. ) Access Rewrite
D. ) Access modify
A. ) Access Change
This is a common security issue that is extremely hard to control in large environments. It occurs
when a user has more computer rights, permissions, and privileges that what is required for the
tasks the user needs to fulfill. What best describes this scenario?
A. ) Excessive Rights
B. ) Excessive Access
C. ) Excessive Permissions
D. ) Excessive Privileges
D. ) Excessive Privileges
One method to simplify the administration of access controls is to group
A. Capabilities and privileges
B. Objects and subjects
C. Programs and transactions
D. Administrators and managers
B. Objects and subjects
To support legacy applications that rely on risky protocols (e.g,"", plain text passwords), which one
of the following can be implemented to mitigate the risks on a corporate network?
A. Implement strong centrally generated passwords to control use of the vulnerable applications.
B. Implement a virtual private network (VPN) with controls on workstations joining the VPN.
C. Ensure that only authorized trained users have access to workstations through physical access
control.
D. Ensure audit logging is enabled on all hosts and applications with associated frequent log
reviews.
B. Implement a virtual private network (VPN) with controls on workstations joining the VPN.

It makes more sense to provide VPN client to workstations opposed to physically securing
workstations.
Which of the following computer crime is more often associated with insiders?
A. ) IP spoofing
B. ) Password sniffing
C. ) Data diddling
D. ) Denial of Service (DOS)
C. ) Data diddling
The technique of skimming small amounts of money from multiple transactions is called the
A. Scavenger technique
B. Salami technique
C. Synchronous attack technique
D. Leakage technique
B. Salami technique
What best describes a scenario when an employee has been shaving off pennies from multiple
accounts and depositing the funds into his own bank account?

A. ) Data fiddling
B. ) Data diddling
C. ) Salami techniques
D. ) Trojan horses
C. ) Salami techniques
What is the act of willfully changing data, using fraudulent input or removal of controls called?
A. Data diddling
B. Data contaminating
C. Data capturing
D. Data trashing
A. Data diddling
In the context of computer security, "scavenging" refers to searching
A. A user list to find a name.
B. Through storage to acquire information.
C. Through data for information content.
D. Through log files for trusted path information
C. Through data for information content.

Scavenging is a form of dumpster diving performed electronically. Online scavenging searches for
useful information in the remnants of data left over after processes or tasks are completed. This
could include audit trails, logs files, memory dumps, variable settings, port mappings, and cached
data . - Ed Tittle CISSP Study Guide (sybex) pg 476
Which security program exists if a user accessing low-level data is able to draw conclusions about
high-level information?
A. Interference
B. Inference
C. Polyinstatiation
D. Under-classification
B. Inference
Which of the following is not a form of a passive attack?
A. ) Scavenging
B. ) Data diddling
C. ) Shoulder surfing
D. ) Sniffing
B. ) Data diddling

Data diddling is an active attack opposed to a passive attack.
Reference: "Data Diddling occurs when an attacker gains access to a system and makes small,
random, or incremental changes to data rather than obviously altering file contents or damaging or
deleting entire files." Pg 383 Tittel
An example of an individual point of verification in a computerized application is
A. An inference check.
B. A boundary protection
C. A sensitive transaction.
D. A check digit.
D. A check digit.


Checksum: A computed value which depends on the contents of a block of data and which is
transmitted or stored along with the data in order to detect corruption of the data. The receiving
system recomputes the checksum based upon the received data and compares this value with the
one sent with the data. If the two values are the same, the receiver has some confidence that the
data was received correctly.
The checksum may be 8 bits (modulo 256 sum), 16, 32, or some other size. It is computed by
summing the bytes or words of the data block ignoring overflow. The checksum may be negated
so that the total of the data words plus the checksum is zero.
Data inference violations can be reduced using
A. Polyinstantiation technique.
B. Rules based meditation.
C. Multi-level data classification.
D. Correct-state transformation
A: Polyinstantiation technique

."Polyinstantiation is the development of a detailed version of an object from another object using
different values in the new object. In the database information security, this term is concerned with
the same primary key for different relations at different classification levels being stored in the
same database. For example, in a relational database, the same of a military unit may be
classified Secret in the database and may have an identification number as the primary key. If
another user at a lower classification level attempts to create a confidential entry for another
military unit using the same identification number as a primary key, a rejection of this attempt
would imply to the lower level user that the same identification number existed at a higher level of
classification. To avoid this inference channel of information, the lower level user would be issued
the same identification number for their unit and the database management system would manage
this situation where the same primary key was used for different units." Pg 352-353 Krutz: The
CISSP Prep Guide: Gold Edition.
What is the main purpose of undertaking a parallel run of a new system?
A. ) Resolve any errors in the program and file interfaces
B. ) Verify that the system provides required business functionality
C. ) Validate the operation of the new system against its predecessor
D. ) Provide a backup of the old system
B. ) Verify that the system provides required business functionality
Which of the following provide network redundancy in a local network environment?
A. ) Mirroring
B. ) Shadowing
C. ) Dual backbones
D. ) Duplexing
C. ) Dual backbones
In which state must a computer system operate to process input/output instructions?
A. User mode
B. Stateful inspection
C. Interprocess communication
D. Supervisor mode
D. Supervisor mode

A computer is in a supervisory state when it is executing these privileged instructions. (privileged
instructions are executed by the system administrator or by an individual who is authorized to use
those instructions.) . -Ronald Krutz The CISSP PREP Guide (gold edition) pg 254-255
What should be the size of a Trusted Computer Base?
A. Small - in order to permit it to be implemented in all critical system components without using
excessive resources.
B. Small - in order to facilitate the detailed analysis necessary to prove that it meets design
requirements.
C. Large - in order to accommodate the implementation of future updates without incurring the
time and expense of recertification.
D. Large - in order to enable it to protect the potentially large number of resources in a typical
commercial system environment
B. Small - in order to facilitate the detailed analysis necessary to prove that it meets design
requirements.


"It must be small enough to be able to be tested and verified in a complete and comprehensive
manner." Shon Harris All-In-One CISSP Certification Guide pg. 232-233.
Which one of the following are examples of security and controls that would be found in a "trusted"
application system?
A. Data validation and reliability
B. Correction routines and reliability
C. File integrity routines and audit trail
D. Reconciliation routines and data labels
C. File integrity routines and audit trail
Which of the following is an operating system security architecture that provides flexible support
for security policies?
A. OSKit
B. LOMAC
C. SE Linux
D. Flask
D. Flask

Flask is an operating system security architecture that provides flexible support for
security policies. The architecture was prototyped in the Fluke research operating
system. Several of the Flask interfaces and components were then ported from the Fluke
prototype to the OSKit. The Flask architecture is now being implemented in the Linux
operating system (Security-Enhanced Linux) to transfer the technology to a larger developer and user community.
Which of the following statements pertaining to the security kernel is incorrect?
A. ) It is made up of mechanisms that fall under the TCB and implements and enforces the
reference monitor concept.
B. ) It must provide isolation for the processes carrying out the reference monitor concept and they
must be tamperproof
C. ) It must be small enough to be able to be tested and verified in a complete and comprehensive
manner
D. ) Is an access control concept, not an actual physical component
D. ) Is an access control concept, not an actual physical component
What is a PRIMARY reason for designing the security kernel to be as small as possible?
A. The operating system cannot be easily penetrated by users.
B. Changes to the kernel are not required as frequently.
C. Due to its compactness, the kernel is easier to formally verify.
D. System performance and execution are enhanced
C. Due to its compactness, the kernel is easier to formally verify.
Which of the following implements the authorized access relationship between subjects and
objects of a system?
A. Security model
B. Reference kernel
C. Security kernel
D. Information flow model
C. Security kernel
The concept that all accesses must be meditated, protected from modification, and verifiable as
correct is the concept of
A. Secure model
B. Security locking
C. Security kernel
D. Secure state
C. Security kernel

A security kernel is defined as the hardware, firmware, and software elements of a trusted
computing base that implements the reference monitor concept. A reference monitor is a system
component that enforces access controls on an object. Therefore, the reference monitor concept
is an abstract machine that mediates all access of subjects to objects. The Security Kernel must:
Mediate all accesses
Be protected from modification
Be verified as correct.
-Ronald Krutz The CISSP PREP Guide (gold edition) pg 262
Which of the following ensures that security is not breached when a system crash or other system
failure occurs?
A. ) trusted recovery
B. ) hot swappable
C. ) redundancy
D. ) secure boot
A. ) trusted recovery
What type of subsystem is an application program that operates outside the operating system and
carries out functions for a group of users, maintains some common data for all users in the group,
and protects the data from improper access by users in the group?
A. Prevented subsystem
B. Protected subsystem
C. File subsystem
D. Directory subsystem
B. Protected subsystem
A 'Pseudo flaw' is which of the following?
A. ) An apparent loophole deliberately implanted in an operating system
B. ) An omission when generating Pseudo-code
C. ) Used for testing for bounds violations in application programming
D. ) A Normally generated page fault causing the system halt
A. ) An apparent loophole deliberately implanted in an operating system
Which of the following yellow-book defined types of system recovery happens after a system fails
in an uncrontrolled manner in response to a TCB or media failure and the system cannot be
brought to a consistent state?
A. ) Recovery restart
B. ) System reboot
C. ) Emergency system restart
D. ) System Cold sta
C. ) Emergency system restart


Explanation:
Reference: "Emergency system restart is done after a system fails in an uncontrolled manner in
response to a TCB or media failure. In such cases, TCB and user objects on nonvolatile storage
belonging to processes active at the time of TCB or media failure may be left in an inconsistent
state. The system enters maintenance mode, recovery is performed automatically, and the system
restarts with no user processes in progress after bringing up the system in a consistent state."
Which one of the following describes a reference monitor?
A. Access control concept that refers to an abstract machine that mediates all accesses to objects
by subjects.
B. Audit concept that refers to monitoring and recording of all accesses to objects by subjects.
C. Identification concept that refers to the comparison of material supplied by a user with its
reference profile.
D. Network control concept that distributes the authorization of subject accesses to objects.
A. Access control concept that refers to an abstract machine that mediates all accesses to objects
by subjects.

A reference monitor is a system component that enforces access controls on an object. Therefore,
the reference monitor concept is an abstract machine that mediates all access of subjects to
objects -Ronald Krutz The CISSP PREP Guide (gold edition) pg 262
What can best be described as an abstract machine which must mediate all access to subjects to
objects?
A. ) A security domain
B. ) The reference monitor
C. ) The security kernel
D. ) The security perimeter
B. ) The reference monitor
What is the PRIMARY component of a Trusted Computer Base?
A. The computer hardware
B. The security subsystem
C. The operating system software
D. The reference monitor
D. The reference monitor


"The security kernel is made up of hardware, software, and firmware components that fall within
the TCB and implements and enforces the reference monitor concept. The security kernel
mediates all access and functions between subjects and objects. The security kernel is the core of
the TCB and is the most commonly used approach to building trusted computing systems. There
are three main requirements of the security kernel:
It must provide isolation for the processes carrying out the reference monitor concept, and the
processes must be tamperproof.
It must be invoked for every access attempt and must be impossible to circumvent. Thus, the
security kernel must be implemented in a complete and foolproof way.
It must be small enough to be able to be tested and verified in a complete and comprehensive
manner.
These are the requirements of the reference monitor; therefore, they are the requirements of the
components that provide and enforce the reference monitor concept-the security kernel." - Shon
Harris, "CISSP All-in-One Exam Guide", 3 rd Ed, p
Which of the following is best defined as a mode of system termination that automatically leaves
system processes and components in a secure state when a failure occurs or is detected in the
system?
A. ) Fail proof
B. ) Fail soft
C. ) Fail safe
D. ) Fail resilient
C. ) Fail safe
LOMAC uses what Access Control method to protect the integrity of processes and data?
A. Linux based EFS.
B. Low Water-Mark Mandatory Access Control.
C. Linux based NFS.
D. High Water-Mark Mandatory Access Control.
LOMAC is a security enhancement for Linux that uses Low Water-Mark Mandatory Access
Control to protect the integrity of processes and data from viruses, Trojan horses,
malicious remote users and compromised root daemons. LOMAC is implemented as a loadable
kernel module - no kernel recompilations or changes to existing applications are
required. Although not all the planned features are currently implemented, it presently
provides sufficient protection to thwart script-kiddies, and is stable enough for
everyday use.
QUESTION NO: 120
On Linux, LOMAC is implemented as:
A. Virtual addresses
B. Registers
C. Kernel built in functions
D. Loadable kernel module
D. Loadable kernel module

LOMAC is a security enhancement for Linux that uses Low Water-Mark Mandatory Access
Control to protect the integrity of processes and data from viruses, Trojan horses,
malicious remote users and compromised root daemons. LOMAC is implemented as a loadable
kernel module - no kernel recompilations or changes to existing applications are
required. Although not all the planned features are currently implemented, it presently
provides sufficient protection to thwart script-kiddies, and is stable enough for
everyday use.
"Security Kernel - The hardware, firmware, and software elements of a trusted computing base
(TCB) that implements the reference monitor concept. It must mediate all accesses between
subjects and objects, be protected from modification, and be verifiable as correct." - Shon Harris
All-in-one CISSP Certification Guide pg 355
LOMAC is a security enhancement for what operating system?
A. Linux
B. Netware
C. Solaris
A. Linux
What was introduced for circumventing difficulties in classic approaches to computer security by
limiting damages produces by malicious programs?
A. Integrity-preserving
B. Reference Monitor
C. Integrity-monitoring
D. Non-Interferenc
B. Reference Monitor
A feature deliberately implemented in an operating system as a trap for intruders is called a:
A. Trap door
B. Trojan horse
C. Pseudo flaw
D. Logic bomb
C. Pseudo flaw
Fault tolerance countermeasures are designed to combat threats to
A. ) an uninterruptible power supply
B. ) backup and retention capability
C. ) design reliability
D. ) data integrity
C. ) design reliability
What Distributed Computing Environment (DCE) component provides a mechanism to ensure that
services are made available only to properly designated parties?
A. Directory Service
B. Remote Procedure Call Service
C. Distributed File Service
D. Authentication and Control Service
A. Directory Service


Explanation:
A directory service has a hierarchical database of users, computers, printers, resources, and
attributes of each. The directory is mainly used for lookup operations, which enable users to track
down resources and other users...The administrator can then develop access control, security,
and auditing policies that dictate who can access these objects, how the objects can be accessed,
and audit each of these actions. - Shon Harris All-in-one CISSP Certification Guide pg 436-437
What can be accomplished by storing on each subject a list of rights the subject has for every
object?
A. Object
B. Capabilities
C. Key ring
D. Rights
B. Capabilities
In the Information Flow Model, what relates two versions of the same object?
A. Flow
B. State
C. Transformation
D. Successive points
A. Flow

A flow is a type of dependency that relates two versions of the same object, and thus
the transformation of one state of that object into another, at successive points in
time.
The Common Criteria (CC) represents requirements for IT security of a product or system under
which distinct categories?
A. Functional and assurance
B. Protocol Profile (PP) and Security Target (ST)
C. Targets of Evaluation (TOE) and Protection Profile (PP)
D. Integrity and control
A. Functional and assurance

"Like other evaluation criteria before it, Common Criteria works to answer two basic and general
questions about products being evaluated: what does it do (functionality), and how sure are you of
that (assurance)?" pg 232 Shon Harris CISSP All-In-One Certification Exam Guide
What are the assurance designators used in the Common Criteria (CC)?
A. EAL 1, EAL 2, EAL 3, EAL 4, EAL 5, EAL 6, and EAL 7
B. A1, B1, B2, B3, C2, C1, and D
C. E0, E1, E2, E3, E4, E5, and E6
D. AD0, AD1, AD2, AD3, AD4, AD5, and AD
A. EAL 1, EAL 2, EAL 3, EAL 4, EAL 5, EAL 6, and EAL 7
Which of the following uses protection profiles and security targets?
A. ) ITSEC
B. ) TCSEC
C. ) CTCPEC
D. ) International Standard 15408
D. ) International Standard 15408

"For historical and continuity purposes, ISO has accepted the continued use of the term "Common
Criteria" (CC) within this document, while recognizing the official ISO name for the new IS 15408
is "Evaluation Criteria for Information Technology Security." Pg. 552 Krutz: The CISSP Prep
Guide: Gold Edition

"The Common Criteria define a Protection Profile (PP), which is an implementation-independent
specification of the security requirements and protections of a product that could be built. The
Common Criteria terminology for the degree of examination of the product to be tested is the
Evaluation Assurance Level (EAL). EALs range from EA1 (functional testing) to EA7 (detailed
testing and formal design verification). The Common Criteria TOE refers to the product to be
tested. A Security Target (ST) is a listing of the security claims for a particular IT security product.
Also, the Common Criteria describe an intermediate grouping of security requirement components
as a package." Pg. 266-267 Krutz: The CISSP Prep Guide: Gold Edition
According to Common Criteria, what can be described as an intermediate combination of security
requirement components?
A. ) Protection profile (PP)
B. ) Security target (ST)
C. ) Package
D. ) The Target of Evaluation (TOE)
C. ) Package


"The Common Criteria define a Protection Profile (PP), which is an implementation-independent
specification of the security requirements and protections of a product that should be built. The
Common Criteria terminology for the degree of examination of the product to be tested is the Evaluation Assurance Level (EAL.) EALs range from EA1 (functional testing() to EA7 (detailed
testing and formal design verification). The Common Criteria TOE refers to the product to be
tested. A Security Target (ST) is a listing of the security claims for a particular IT security product.
Also, the Common Criteria describe an intermedicate grouping of security requirement
components as a package."
what principal allows us to identify aspects of the person responsible for a crime, whenever committing a crime, the perpetrator takes somthing with him and leaves somthing behind?

A. Meye'rs principal of legal imunity

b. criminalistic principals

c. ioce/group of 8 nations principals for computer forensics

c. locards principal of exchange
locard's principal of exchange.

locards principle of exchange states that when a crime is committed, the perpetrators leave something behind and take something with them, hence the exchange. the principle allows us to identity aspects of the persons responsible, even with a purely digital crime scene.
which type of intellectual property protects the goodwill a merchant or vendor invest in its products?

Trademark

patent

copyright

trade secret
Trademark


Trademark laws are designed to protect the goodwill a merchant or vendor invest in its products.
which of the following is not one of the five rules of evidence?


be authentic

be redundant

be complete

be admissible
redundent

evidence should be: authentic, be accurate, be complete be convincing, and be admissible.
Integrity of a forensic bit stream images is often determined by:

comparing hash totals to the original source

keeping good notes

taking pictures

can never be proven
comparing hash totals to the original source.
computer forensics is really the marriage of computer science, information technology, and engineering with:

law

informations systems

analytical thought

the scientific method
LAW
which of the following is not a computer forensics model?

Ioce

swgde

mom

acpo
MOM


Like incident response. there are various computer forensics guidelines.


internations organiztion of computer evidence (IOCE)

Scientific Working Group on Digital Evidence (SWGDE), association of chief police officers (ACPO) these are valid computer forensic models.
an analysis of an e-mail server recordes several hundred emails being sent out anonymously during a time of normally low network activity. thisis an example of wich of the follwing?

an event

an incident

a hacker gaining administrator


a hacker gaining administrator access

phishing or spam activity
An event.


An event is an observable occurrence. occurrence.
wich of the following is not a category of software licensing?

freeware

commercial

academic

end-user licensing agreement
end-user licensing agreement
a case of simple libel in wich the defendant is fined a sum of money to be paid as restitution is an example of wich of the following types of laws?

criminal law

civil law

administrative law

religious law
Civil (tort) Law

civil (tort) laws are laws enacted to protect individuals or businesses. Violation of these laws result in financial restitution or compensatory damages but in imprisonment.
computer records indication names and addresses of clients as well as records of sales used in court as evdence agains a drug dealer is an example of wich of the follwing?

computer assited crime

computer targeted crime

computer is incidental to the crime

computer misuse crime
computer is incidental to the crime.
what are the rights and obligations of individuals and organizations with repsect to the collection, use, retention, and disclosure of personal information related to?

privacy

secrecy

availabitlity

reliablitity
privacy
prior to installing video surveillance cameras in the workplace, which of the following must be performed?

locations of intended cameras must be marked

a sign on ach entry door must identify the use of surveillance cameras.

a regional board of inquiry must approve the surveillance

a policy must be created and distributed to all relevant employees.
a policy must be created and distributed to all relevant employees.
when dealing with digital evidence, the crime scene:

must never be alterd

must be completely reproducible in the court of law

must have the least amount of contamination that is possible.
must have the least amount of contamination that is possible.
what is the biggest hinrance to dealing with computer crime?

computer criminals are gnerally smarter than computer investigators.

adequate funding to stay ahead of the computer criminals

activity associated with computer crime is truly international

there are so many more computer criminals than investigators that it is impossible to keep up.
activity associated with computer crime is truly international
the goal computer forensics is to examin and analyze computer data in such a manner that it can be

used as evidence in a court of law

maintained without corruption

tracked thru a chain of custody

copied while maintaining integrity
used as evidence in the a court of law.
where does the greatest risk of cybercrime come from?

outsiders

nations-states

insiders

script kiddies
insiders
Triage encompasses which type of the following incident response subphases?

collection, transport, testimony

traceback, feedback, loopback

detection, identification,
notification

confidentiality, integrity, availability.
detection, identification, notification.
if a dealrship makes a permanet recoding of personal information and sells that information to an automobile insurance company, which of the following have been violated?

copyright

health insurance portability and accountability

European privacy principles

the 1998 personal accountability act
European privacy principles

The European privacy principles allow data to only be used for the purposes for which collected and only for a reasonable time.
which type of intellectual property covers the expression of ideas rather than ideas themselves?

tradmark

patent

copyright

trade secret
copyright

a cop right covers the expression of ideas rather than the ideas themselves: it usually protects artistic property such as writing, recordings, databases ad computer programs.
what is not mentioned as a phase of an incident response?

analysis

prosecution

containment

investigation
prosecution

the incident response and handling phase can be broken down further into triage, investigation, containment, and analysis and tracking.
The _________ emphasizes that abstract concepts of law and is influenced by the writings of legal scholars and academics.

criminal law

civil law

religious law

administrative law
civil law.


civil law emphasizes the abstract concepts of law and is influenced by the writings of legal scholars and academics, more so than common law systems.