Updated Feb 22, 2022 Test Engine to Practice Test for CISSP Valid and Updated Dumps
Exam Questions for CISSP Updated Versions With Test Engine
How to earn PCSA credentials?
The candidate must earn 50 continuing education units (CEUs) for the PCSA credential. The CEUs may be earned through participation in the ISSA - ISC2 Security Forum of Interest Community of Interest (COI), attendance at an Information Systems Security Association (ISSA) certified training course, obtaining CEUs from any other Information Systems Security Association or Information Systems Audit and Control Association (ISACA) member, obtaining certification credits for passing the exam, or through participating in many other online sites. The Professional level requires passing two exams to achieve. The PCSA credential is defined as conforming to the requirements of NCEES, the American Society for Testing and Materials (ASTM), and the International Information Systems Security Certification Consortium (ISC). The test will not earn a CISSP valid certification.
How could you focus on ISC CISSP Certification Exam
Right here is the exam overview for ISC CISSP Certification Exam
ISC CISSP Certification Exam: Get our snappy guide in the event that you don't have the opportunity to peruse all the page
The CISSP certification was developed by the International Information Systems Security Certification Consortium (ISC) and is widely considered one of the most difficult certifications to attain. The CISSP exam tests for knowledge of concepts such as network security, software security, cryptography, physical security, and general security principles. Candidates must pass a rigorous 8-hour long exam and demonstrate proficiency in at least 10 out of 12 knowledge areas. This article will provide you with some useful tips on how to prepare for the ISC CISSP certification exam by studying CISSP Dumps and what to expect during the day of your test.
NEW QUESTION 318
Which of the following service is not provided by a public key infrastructure (PKI)?
- A. Access control
- B. Authentication
- C. Reliability
- D. Integrity
Answer: C
Explanation:
A Public Key Infrastructure (PKI) provides confidentiality, access control, integrity,
authentication and non-repudiation.
It does not provide reliability services.
Reference(s) used for this question:
TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.
NEW QUESTION 319
The classic Caesar cipher is a:
- A. Transposition cipher.
- B. Code group.
- C. Polyalphabetic cipher.
- D. Monoalphabetic cipher.
Answer: D
Explanation:
The correct answer is Monoalphabetic cipher. It uses one alphabet shifted three places.
Answers Polyalphabetic cipher and Transposition cipher are incorrect because in answer a, multiple alphabets are used and in answer Transposition cipher, the letters of the message are transposed.
Answer Code group is incorrect because code groups deal with words
and phrases and ciphers deal with bits or letters.
NEW QUESTION 320
If the application of a hash function results in an m-bit fixed length
output, an attack on the hash function that attempts to achieve a
collision after 2 m/2 possible trial input values is called a(n):
- A. Birthday attack
- B. Chosen-ciphertext attack
- C. Adaptive-chosen-plaintext attack
- D. Meet-in-the-middle attack
Answer: A
Explanation:
This problem is analogous to asking the question How many
people must be in a room for the probability of two people having
the same birthday to be equal to 50%? The answer is 23. Thus,
trying 2m/2 possible trial inputs to a hash function gives a 50%
chance of finding two inputs that have the same hash value. Answer
a, describes an attack in which the attacker can choose the plaintext
to be encrypted and can modify his/her choice based on the results
of a previous encryption.
* Answer the chosen-cipher text attack is where the attacker can select different ciphertexts to be decrypted and has the decrypted plaintext available. This attack is used to determine the key or keys being used. Answer d is an attack against double encryption. This approach shows that for a key length of k bits, a chosen-plaintext attack could find the key after 2k+1 trials
instead of 22k attempts. In this attack on double encryption, one
encrypts from one end, decrypts from the other and compares the
results in-the-middle.
NEW QUESTION 321
A system is developed so that its business users can perform business functions but not user administration functions. Application administrators can perform administration functions but not user business functions.
These capabilities are BEST described as
- A. separation of duties.
- B. rule based access controls.
- C. least privilege.
- D. Mandatory Access Control (MAC).
Answer: A
NEW QUESTION 322
Zip/Jaz drives are frequently used for the individual backups of small data sets of:
- A. dynamic application data
- B. specific application data
- C. static application data
- D. sacrificial application data
Answer: B
NEW QUESTION 323
Who developed one of the first mathematical models of a multilevel-security computer system?
- A. Clark and Wilson.
- B. Diffie and Hellman.
- C. Bell and LaPadula.
- D. Gasser and Lipner.
Answer: C
Explanation:
In 1973 Bell and LaPadula created the first mathematical model of a multi- level security system.
The following answers are incorrect:
Diffie and Hellman. This is incorrect because Diffie and Hellman was involved with cryptography.
Clark and Wilson. This is incorrect because Bell and LaPadula was the first model. The
Clark-Wilson model came later, 1987.
Gasser and Lipner. This is incorrect, it is a distractor. Bell and LaPadula was the first model.
NEW QUESTION 324
Which of the following could be considered the MOST significant security challenge when adopting DevOps practices compared to a more traditional control framework?
- A. Achieving Service Level Agreements (SLA) on how quickly patches will be released when a security flaw is found.
- B. Maintaining segregation of duties.
- C. Availability of security teams at the end of design process to perform last-minute manual audits and reviews.
- D. Standardized configurations for logging, alerting, and security metrics.
Answer: B
Explanation:
Section: Security Architecture and Engineering
NEW QUESTION 325
Which of the following issues is not addressed by digital signatures?
- A. nonrepudiation
- B. data integrity
- C. authentication
- D. denial-of-service
Answer: D
Explanation:
A digital signature directly addresses both confidentiality and integrity of the
CIA triad. It does not directly address availability, which is what denial-of-service attacks.
The other answers are not correct because:
"nonrepudiation" is not correct because a digital signature can provide for nonrepudiation.
"authentication" is not correct because a digital signature can be used as an authentication mechanism
"data integrity" is not correct because a digital signature does verify data integrity (as part of nonrepudiation)
References:
Official ISC2 Guide page: 227 & 265
All in One Third Edition page: 648
NEW QUESTION 326
Which of the following is the BEST statement for a professional to include as port of businees continuity (BC) procedure?
- A. A full data backup must be done upon management request.
- B. An incremental data backup must be done upon management request.
- C. In incremental data backup must be done after each system change.
- D. A full data backup must be done based on the needs of the business.
Answer: C
NEW QUESTION 327
Operations Security seeks to primarily protect against which of the following?
- A. compromising emanations
- B. object reuse
- C. facility disaster
- D. asset threats
Answer: D
Explanation:
The correct answer is asset threats. A threat is any circumstance or event with the potential to cause harm.
The most important reason for identifying threats is to know from what do the assets need protection and what is the likelihood that a threat will occur. Threats cannot be eliminated, but can be anticipated, and safeguards put in place to minimize their impact.
Operations Security provides audit and monitoring for mechanisms, tools and facilities which permit the identification of security events and documentation of subsequent corrective actions.
Source: State of Nebraska - Information Security Systems (ISS) Security Officer Instruction Guide.
NEW QUESTION 328
When designing a vulnerability test, which one of the following is likely to give the BEST indication of what components currently operate on the network?
- A. Ping testing
- B. Asset register
- C. Topology diagrams
- D. Mapping tools
Answer: A
NEW QUESTION 329
How many bits compose an IPv6 address?
- A. 64 bits
- B. 32 bits
- C. 128 bits
- D. 96 bits
Answer: C
Explanation:
The actual IP address (IPv4) is composed of 32 bits. An IPv6 address is composed of 128 bits. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page 87).
NEW QUESTION 330
Which integrity model defines a constrained data item, an integrity verification procedure and a transformation procedure?
- A. The Bell-LaPadula integrity model
- B. The Clark Wilson integrity model
- C. The Take-Grant model
- D. The Biba integrity model
Answer: B
Explanation:
Explanation/Reference:
Explanation:
When an application uses the Clark-Wilson model, it separates data into one subset that needs to be highly protected, which is referred to as a constrained data item (CDI), and another subset that does not require a high level of protection, which is called an unconstrained data item (UDI). Users cannot modify critical data (CDI) directly. Instead, the subject (user) must be authenticated to a piece of software, and the software procedures (Transformation Procedures) will carry out the operations on behalf of the user. For example, when Kathy needs to update information held within her company's database, she will not be allowed to do so without a piece of software controlling these activities. First, Kathy must authenticate to a program, which is acting as a front end for the database, and then the program will control what Kathy can and cannot do to the information in the database.
Incorrect Answers:
A: The take-grant protection model is used to establish or disprove the safety of a given computer system that follows specific rules. This is not what is described in the question.
B: The Biba Model is a formal state transition system of computer security policy that describes a set of access control rules designed to ensure data integrity. However, it does not define a constrained data item and a transformation procedure.
C: The Bell-LaPadula model does not deal with integrity.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 374
NEW QUESTION 331
What is considered the MOST important type of error to avoid for a biometric access control system?
- A. Crossover Error Rate
- B. Type II Error
- C. Type I Error
- D. Combined Error Rate
Answer: B
Explanation:
Explanation/Reference:
Explanation:
A Type II Error occurs when the system accepts impostors who should be rejected. This type of error is the most dangerous type, and therefore the most important to avoid.
Incorrect Answers:
A: A Type I Error is when a biometric system rejects an authorized individual. It is not as dangerous as a Type II Error, and therefore not the most important to avoid.
C: Combined Error Rate is not a valid type of biometric error.
D: The crossover error rate (CER) is a percentage that signifies the point at which the false rejection rate equals the false acceptance rate. It is the most important measurement when determining the system's accuracy.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 188
NEW QUESTION 332
Remote Procedure Call (RPC) is a protocol that one program can use to request a service from a program located in another computer in a network. Within which OSI/ISO layer is RPC implemented?
- A. Transport layer
- B. Session layer
- C. Data link layer
- D. Network layer
Answer: B
Explanation:
The following answers are incorrect:
Transport layer: The Transport layer handles computer-to computer communications, rather than
application-to-application communications like RPC.
Data link Layer: The Data Link layer protocols can be divided into either Logical Link Control (LLC)
or Media Access Control (MAC) sublayers. Protocols like SLIP, PPP, RARP and L2TP are at this
layer. An application-to-application protocol like RPC would not be addressed at this layer.
Network layer: The Network Layer is mostly concerned with routing and addressing of information,
not application-to-application communication calls such as an RPC call.
The following reference(s) were/was used to create this question:
The Remote Procedure Call (RPC) protocol is implemented at the Session layer, which
establishes, maintains and manages sessions as well as synchronization of the data flow.
Source: Jason Robinett's CISSP Cram Sheet: domain2.
Source: Shon Harris AIO v3 pg. 423
NEW QUESTION 333
Which of the following answers is the BEST example of Risk Transference?
- A. Insurance
- B. Results of Cost Benefit Analysis
- C. Acceptance
- D. Not hosting the services at all
Answer: A
Explanation:
When we operate an organizational information system we are accepting a tolerable level of risk to allow the business functions to operate.
There may be risks you are not qualified to accept or risks you would be better off having undertaken by an outside entity.
A classic example is having your popular web server hosted by a web hosting agency which completely relieves you of the risks associated with that.
Another example is insurance where you offload the risk to an insurance agency and pay them to accept the risk.
When we transfer risk we are giving the risk to someone else to accept and it could be for a number of reasons. Expense primarily but it could also be performance, offers of better service elsewhere, legal reasons and other reasons.
The following answers are incorrect:
-Results of Cost Benefit Analysis: This might be involved in the process of Risk Mitigation but it isn't part of Risk Transference. Sorry, wrong answer.
-Acceptance: This isn't correct because accepting the risk is the opposite of transferring the risk to someone else.
-Not hosting the services at all: Sorry, this defines Risk Avoidance.
The following reference(s) was used to create this question: 2013. Official Security+ Curriculum.
NEW QUESTION 334
Which of the following is TRUE regarding Transmission Control Protocol (TCP) and User Datagram Protocol (UDP)?
- A. UDP is useful for longer messages, rather than TCP.
- B. TCP does not guarantee delivery of data, while UDP does guarantee data delivery.
- C. UDP provides for Error Correction, TCP does not.
- D. TCP is connection-oriented, UDP is not.
Answer: D
Explanation:
TCP is a reliable connection-oriented transport for guaranteed delivery of data.
Protocols represent certain rules and regulations that are essential in order to have data
communication between two entities. Internet Protocols work in sending and receiving data packets. This type of communication may be either connection-less or connection-oriented. In a connection-oriented scenario, an acknowledgement is being received by the sender from the receiver in support of a perfect transfer. Transmission Control Protocol or TCP is such a protocol. On the other hand, UDP or User Datagram Protocol is of the connection-less type where no feedback is being forwarded to the sender after delivery and the data transfer have taken place or not. Though, it's not a guaranteed method, but, once a connection is established, UDP works much faster than TCP as TCP has to rely on a feedback and accordingly, the entire 3-way handshaking takes place.
The following answers are incorrect:
UDP provides for Error Correction, TCP does not: UDP does not provide for error correction, while TCP does.
UDP is useful for longer messages, rather than TCP: UDP is useful for shorter messages due to its connectionless nature.
TCP does not guarantee delivery of data, while UDP does guarantee data delivery: The opposite is true.
References Used for this question:
http://www.cyberciti.biz/faq/key-differences-between-tcp-and-udp-protocols/
http://www.skullbox.net/tcpudp.php
James's TCP-IP FAQ - Understanding Port Numbers.
NEW QUESTION 335
During an audit, the auditor finds evidence of potentially illegal activity. Which of the
following is the MOST appropriate action to take?
- A. Advise the person performing the illegal activity to cease and desist
- B. Work with the client to resolve the issue internally
- C. Immediately call the police
- D. Work with the client to report the activity to the appropriate authority
Answer: D
NEW QUESTION 336
Compact Disc (CD) optical media types is used more often for:
- A. larger data sets
- B. very small data sets
- C. very small files data sets
- D. very aggregated data sets
Answer: B
NEW QUESTION 337
What is the length of an MD5 message digest?
- A. 128 bits
- B. varies depending upon the message size.
- C. 256 bits
- D. 160 bits
Answer: A
Explanation:
Explanation/Reference:
Explanation:
MD5 is a message digest algorithm that was developed by Ronald Rivest in 1991. MD5 takes a message of an arbitrary length and generates a 128-bit message digest. In MD5, the message is processed in 512- bit blocks in four distinct rounds.
Incorrect Answers:
B: MD5 generates a 128-bit message digest, not 160-bit.
C: MD5 generates a 128-bit message digest, not 256-bit.
D: MD5 generates a 128-bit message digest regardless of the message size.
Krutz, Ronald L. and Russel Dean Vines, The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, New York, 2001, p. 153
NEW QUESTION 338
When designing a vulnerability test, which one of the following is likely to give the BEST indication of what components currently operate on the network?
- A. Asset register
- B. Mapping tools
- C. Topology diagrams
- D. Ping testing
Answer: B
NEW QUESTION 339
Which is NOT a property of or issue with tape backup?
- A. Server disk space utilization expands
- B. Slow data transfer during backups and restores
- C. The possibility that some data re-entry might need to be performed
after a crash - D. One large disk created by using several disks
Answer: D
Explanation:
The correct answer is "One large disk created by using several disks". RAID level 0 striping is the process of creating a large disk out of several smaller disks.
NEW QUESTION 340
......
CISSP Exam Dumps - Free Demo & 365 Day Updates: https://www.dumpstests.com/CISSP-latest-test-dumps.html
Pass CISSP Exam with Updated CISSP Exam Dumps PDF: https://drive.google.com/open?id=10ChK8juIcxDxPE5CNHze16dM2lI7zWRG