[Mar-2023] Verified CISSP dumps Q&As - CISSP dumps with Correct Answers
The Best ISC Certification Study Guide for the CISSP Exam
ISC2 CISSP Exam Certification Details:
| Schedule Exam | Pearson VUE |
| Passing Score | 700/1000 |
| Exam Code | CISSP |
| Sample Questions | ISC2 CISSP Sample Questions |
What are PCSA credentials?
The Professional level normally requires earning six exams to achieve, while associate requires six exams to achieve. The Associate exam is an objective test that candidates can take online or on skype, while professional exam candidates only have access to one option. The PCSA consists of a single certification covering information security management principles and concepts. It provides a foundation for the core skills required of entry-level information security professionals and the fundamental knowledge for career growth into more advanced positions, or to prepare for certifications at a higher level. Passing this exam does not qualify a candidate for any CISSP certification nor does it make an individual eligible for any other ISC credential.
NEW QUESTION 80
Removing unnecessary processes, segregating inter-process communications, and reducing executing privileges to increase system security is commonly called
- A. Hardening
- B. Kerneling
- C. Aggregating
- D. Segmenting
Answer: A
Explanation:
What is hardening? Naturally, there is more than one definition, but in general, one tightens control using policies which affect authorization, authentication and permissions. Nothing happens by default. You only give out permission after thinking about it, something like "deny all" to everyone, then "allow" with justification. Shut off everything, then only turn on that which must be turned on. It is not unlike locking every single door, window and access point in your house, then unlocking only those that need to be. It is quite common for users to take all the defaults when their new system gets turned on making for instant vulnerability. A major problem is trying to figure out where all those details are that need to be turned off, without making the system unusable.
NEW QUESTION 81
What is called the type of access control where there are pairs of elements that have the least upper bound of values and greatest lower bound of values?
- A. Mandatory model
- B. Rule model
- C. Discretionary model
- D. Lattice model
Answer: D
Explanation:
Explanation/Reference:
Explanation:
A lattice is a mathematical construct that is built upon the notion of a group. The most common definition of the lattice model is "a structure consisting of a finite partially ordered set together with least upper and greatest lower bound operators on the set." Two methods are commonly used for applying mandatory access control:
Rule-based (or label-based) access control: This type of control further defines specific conditions for
access to a requested object. A Mandatory Access Control system implements a simple form of rule- based access control to determine whether access should be granted or denied by matching:
- An object's sensitivity label
- A subject's sensitivity label
Lattice-based access control: These can be used for complex access control decisions involving
multiple objects and/or subjects. A lattice model is a mathematical structure that defines greatest lower- bound and least upper-bound values for a pair of elements, such as a subject and an object.
Incorrect Answers:
A: The model described in the question is a type of mandatory access control. However, the Lattice Model is specifically described in the question.
B: A discretionary model is not what is described in the question.
D: A rule model is not what is described in the question.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 381
https://en.wikipedia.org/wiki/Computer_access_control
NEW QUESTION 82
Which of the following is most relevant to determining the maximum effective cost of access control?
- A. the cost to replace lost data.
- B. the value of information that is protected.
- C. management's perceptions regarding data importance.
- D. budget planning related to base versus incremental spending.
Answer: B
Explanation:
The cost of access control must be commensurate with the value of the information that is being protected. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 49
NEW QUESTION 83
Vulnerability scanners may allow for the administrator to assign which of the following in order to assist in prioritizing remediation activities?
- A. Asset values for networks
- B. Vulnerability attack vectors
- C. Definitions for each exposure type
- D. Exploit code metrics
Answer: A
Explanation:
Section: Mixed questions
NEW QUESTION 84
Which choice below BEST describes coaxial cable?
- A. Coax consists of a hollow outer cylindrical conductor surrounding a
single, inner conductor. - B. Coax does not require a fixed spacing between connections that UTP requires.
- C. Coax carries signals as light waves.
- D. Coax consists of two insulated wires wrapped around each other in a regular spiral pattern.
Answer: A
Explanation:
The correct answer is "Coax consists of a hollow outer cylindrical conductor surrounding a single,
inner conductor". Coax consists of a hollow outer cylindrical conductor surrounding a single, inner
wire conductor.
Answer "Coax consists of two insulated wires wrapped around each other in a regular spiral
pattern" describes UTP. Coax requires fixed spacing between connections, and answer "Coax
carries signals as light waves" describes fiber-optic cable.
NEW QUESTION 85
An access control list (ACL) on a router is a feature MOST similar to which type of firewall?
- A. Heuristic firewall
- B. Application gateway firewall
- C. Packet filtering firewall
- D. Stateful firewall
Answer: B
NEW QUESTION 86
In a Public Key Infrastructure, how are public keys published?
- A. They are sent via e-mail.
- B. They are sent by owners.
- C. They are not published.
- D. Through digital certificates.
Answer: D
Explanation:
Public keys are published through digital certificates, signed by certification authority (CA), binding the certificate to the identity of its bearer.
A bit more details:
Although "Digital Certificates" is the best (or least wrong!) in the list of answers presented, for the past decade public keys have been published (ie: made known to the World) by the means of a LDAP server or a key distribution server (ex.: http://pgp.mit.edu/). An indirect publishing method is through OCSP servers (to validate digital signatures' CRL)
Reference used for this question:
TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.
and
http://technet.microsoft.com/en-us/library/dd361898.aspx
NEW QUESTION 87
An organization publishes and periodically updates its employee policies in a file on their intranet. Which of the following is a PRIMARY security concern?
- A. Ownership
- B. Confidentiality
- C. Availability
- D. Integrity
Answer: C
Explanation:
Section: Software Development Security
NEW QUESTION 88
Which of the following would describe a type of biometric error refers to as false rejection rate?
- A. Type II error
- B. CER error
- C. Type III error
- D. Type I error
Answer: D
Explanation:
When a biometric system rejects an authorized individual, it is called a Type I error.
When a system accepts impostors who should be rejected (false positive), it is called a Type II
error.
The Crossover Error Rate (CER), stated in a percentage, represents the point at which false
rejection (Type I) rate equals the false acceptance (Type II) rate.
Type III error is not defined and simply a distracter in this case. Some people get trick on this one
because they are thinking about Authentication Factors where Biometric is a type III authentication
factor.
Beware not to mix authentication factor with biometric errors. The 3 authentication factors are:
Type 1 Something you know
Type 2 Something you have
Type 3 Something you are
Reference(s) used for this question:
HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter
4: Access Control (page 128).
and
https://pciguru.wordpress.com/2010/05/01/one-two-and-three-factor-authentication/
NEW QUESTION 89
The design review for an application has been completed and is ready for release. What technique should an organization use to assure application integrity?
- A. Input validation
- B. Application authentication
- C. Digital signing
- D. Device encryption
Answer: C
Explanation:
Section: Software Development Security
Explanation
NEW QUESTION 90
Which of the following is NOT a type of motion detector?
- A. Ultrasonic Sensor.
- B. Passive infrared sensors
- C. Microwave Sensor.
- D. Photoelectric sensor
Answer: D
Explanation:
Explanation/Reference:
Explanation:
A photoelectric sensor does not detect motion; it detects a break in a beam of light.
A photoelectric system, or photometric system, detects the change in a light beam. These systems work like photoelectric smoke detectors, which emit a beam that hits the receiver. If this beam of light is interrupted, an alarm sounds. The beams emitted by the photoelectric cell can be cross-sectional and can be invisible or visible beams. Cross-sectional means that one area can have several different light beams extending across it, which is usually carried out by using hidden mirrors to bounce the beam from one place to another until it hits the light receiver.
Incorrect Answers:
B: A passive infrared system (PIR) identifies the changes of heat waves in an area it is configured to monitor. If the particles' temperature within the air rises, it could be an indication of the presence of an intruder, so an alarm is sounded. A PIR is a type of motion detector. Therefore, this answer is incorrect.
C: Wave-pattern motion detectors differ in the frequency of the waves they monitor. The different frequencies are microwave, ultrasonic, and low frequency. All of these devices generate a wave pattern that is sent over a sensitive area and reflected back to a receiver. If the pattern is returned undisturbed, the device does nothing. If the pattern returns altered because something in the room is moving, an alarm sounds. A Microwave Sensor is a type of motion detector. Therefore, this answer is incorrect.
D: An Ultrasonic Sensor is an example of a wave-pattern motion detector. Therefore, this answer is incorrect.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 495
NEW QUESTION 91
A large corporation is locking for a solution to automate access based on where on request is coming from, who the user is, what device they are connecting with, and what time of day they are attempting this access.
What type of solution would suit their needs?
- A. Network Access Control (NAC)
- B. Discretionary Access Control (DAC)
- C. Role Based Access Control (RBAC)
- D. Mandater Access Control (MAC)
Answer: A
NEW QUESTION 92
Regarding asset security and appropriate retention, which of the following INITIAL top three areas are important to focus on?
- A. Human resources, asset management, production management
- B. Polygraphs, crime statistics, forensics
- C. Security control baselines, access controls, employee awareness and training
- D. Supply chain lead time, inventory control, encryption
Answer: C
NEW QUESTION 93
What is the name of the software that prevents users from seeing all items or directories on a computer and is most commonly found in the UNIX/Linux environment?
- A. Shadow data
- B. Root Kits
- C. Netbus
- D. Ethereal
- E. Shell Kits
Answer: A
Explanation:
Shadowing, used for Unix password files hides the password hash.
IF SHAWDOWING IS ACTIVE:
------------------------
If the shawdowing is active the /etc/passwd would look like this:
root:x:0:1:0000:/:
sysadm:x:0:0:administration:/usr/admin:/bin/rsh
The password filed is substituted by "x".
The /etc/shawdow file only readable by root will look similar to
this:
root:D943/sys34:5288::
super user accounts
Cathy:masai1:5055:7:120
all other users
The first field contains users id:the second contains the password(The pw will be NONE if logining in remotely is deactivated):the third contains a code of when the password was last changed:the fourth and the fifth contains the minimum and the maximum numbers of days for pw changes(Its rare that you will find this in the super user logins due to there hard to guess passwords)
NEW QUESTION 94
The security accreditation task of the System Development Life Cycle (SDLC) process is completed at the end of which phase?
- A. System acquisition and development
- B. System operations and maintenance
- C. System implementation
- D. System initiation
Answer: B
NEW QUESTION 95
Physical security is accomplished through proper facility construction, fire and water protection, anti-theft mechanisms, intrusion detection systems, and security procedures that are adhered to and enforced.
Which of the following is NOT a component that achieves this type of security?
- A. Technical control mechanisms
- B. Physical control mechanisms
- C. Integrity control mechanisms
- D. Administrative control mechanisms
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Integrity controls are not one of the three defined security control types.
Controls are put into place to reduce the risk an organization faces, and they come in three main flavors:
administrative, technical, and physical. Administrative controls are commonly referred to as "soft controls" because they are more management-oriented. Examples of administrative controls are security documentation, risk management, personnel security, and training. Technical controls (also called logical controls) are software or hardware components, as in firewalls, IDS, encryption, identification and authentication mechanisms. And physical controls are items put into place to protect facility, personnel, and resources. Examples of physical controls are security guards, locks, fencing, and lighting.
Incorrect Answers:
A: Security procedures are an example of administrative controls. Therefore, this answer is incorrect.
C: An intrusion detection system is an example of technical controls. Therefore, this answer is incorrect.
D: The facility construction, fire and water protection are examples of physical controls. Therefore, this answer is incorrect.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 28
NEW QUESTION 96
Rule-Based Access Control (RuBAC) access is determined by rules. Such rules would fit within what category of access control?
- A. Mandatory Access control (MAC)
- B. Non-Discretionary Access Control (NDAC)
- C. Discretionary Access Control (DAC)
- D. Lattice-based Access control
Answer: B
Explanation:
Rule-based access control is a type of non-discretionary access control because this access is determined by rules and the subject does not decide what those rules will be, the rules are uniformly applied to ALL of the users or subjects.
In general, all access control policies other than DAC are grouped in the category of non- discretionary access control (NDAC). As the name implies, policies in this category have rules that are not established at the discretion of the user. Non-discretionary policies establish controls that cannot be changed by users, but only through administrative action.
Both Role Based Access Control (RBAC) and Rule Based Access Control (RuBAC) fall within Non Discretionary Access Control (NDAC). If it is not DAC or MAC then it is most likely NDAC.
IT IS NOT ALWAYS BLACK OR WHITE
The different access control models are not totally exclusive of each others. MAC is making use of Rules to be implemented. However with MAC you have requirements above and beyond having simple access rules. The subject would get formal approval from management, the subject must have the proper security clearance, objects must have labels/sensitivity levels attached to them, subjects must have the proper security clearance.
If all of this is in place then you have MAC.
BELOW YOU HAVE A DESCRIPTION OF THE DIFFERENT CATEGORIES:
MAC = Mandatory Access Control
Under a mandatory access control environment, the system or security administrator will define what permissions subjects have on objects. The administrator does not dictate user's access but simply configure the proper level of access as dictated by the Data Owner.
The MAC system will look at the Security Clearance of the subject and compare it with the object sensitivity level or classification level. This is what is called the dominance relationship.
The subject must DOMINATE the object sensitivity level. Which means that the subject must have a security clearance equal or higher than the object he is attempting to access.
MAC also introduce the concept of labels. Every objects will have a label attached to them indicating the classification of the object as well as categories that are used to impose the need to know (NTK) principle. Even thou a user has a security clearance of Secret it does not mean he would be able to access any Secret documents within the system. He would be allowed to access only Secret document for which he has a Need To Know, formal approval, and object where the user belong to one of the categories attached to the object.
If there is no clearance and no labels then IT IS NOT Mandatory Access Control.
Many of the other models can mimic MAC but none of them have labels and a dominance relationship so they are NOT in the MAC category.
NISTR-7316 Says:
Usually a labeling mechanism and a set of interfaces are used to determine access based on the MAC policy; for example, a user who is running a process at the Secret classification should not be allowed to read a file with a label of Top Secret. This is known as the "simple security rule," or "no read up." Conversely, a user who is running a process with a label of Secret should not be allowed to write to a file with a label of Confidential.
This rule is called the "*-property" (pronounced "star property") or "no write down." The *- property is required to maintain system security in an automated environment. A variation on this rule called the "strict *-property" requires that information can be written at, but not above, the subject's clearance level. Multilevel security models such as the Bell-La Padula
Confidentiality and Biba Integrity models are used to formally specify this kind of MAC policy.
DAC = Discretionary Access Control
DAC is also known as: Identity Based access control system.
The owner of an object is define as the person who created the object. As such the owner has the discretion to grant access to other users on the network. Access will be granted based solely on the identity of those users.
Such system is good for low level of security. One of the major problem is the fact that a user who has access to someone's else file can further share the file with other users without the knowledge or permission of the owner of the file. Very quickly this could become the wild west as there is no control on the dissemination of the information.
RBAC = Role Based Access Control
RBAC is a form of Non-Discretionary access control.
Role Based access control usually maps directly with the different types of jobs performed by employees within a company.
For example there might be 5 security administrator within your company. Instead of creating each of their profile one by one, you would simply create a role and assign the administrators to the role. Once an administrator has been assigned to a role, he will
IMPLICITLY inherit the permissions of that role.
RBAC is great tool for environment where there is a a large rotation of employees on a daily basis such as a very large help desk for example.
RBAC or RuBAC = Rule Based Access Control
RuBAC is a form of Non-Discretionary access control.
A good example of a Rule Based access control device would be a Firewall. A single set of rules is imposed to all users attempting to connect through the firewall.
NOTE FROM CLEMENT:
Lot of people tend to confuse MAC and Rule Based Access Control.
Mandatory Access Control must make use of LABELS. If there is only rules and no label, it cannot be Mandatory Access Control. This is why they call it Non Discretionary Access control (NDAC).
There are even books out there that are WRONG on this subject. Books are sometimes opiniated and not strictly based on facts.
In MAC subjects must have clearance to access sensitive objects. Objects have labels that contain the classification to indicate the sensitivity of the object and the label also has categories to enforce the need to know.
Today the best example of rule based access control would be a firewall. All rules are imposed globally to any user attempting to connect through the device. This is NOT the case with MAC.
I strongly recommend you read carefully the following document:
NISTIR-7316 at http://csrc.nist.gov/publications/nistir/7316/NISTIR-7316pdf
It is one of the best Access Control Study document to prepare for the exam. Usually I tell people not to worry about the hundreds of NIST documents and other reference. This document is an exception. Take some time to read it.
Reference(s) used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, 2001, John Wiley & Sons, Page 33
And
NISTIR-7316 at http://csrc.nist.gov/publications/nistir/7316/NISTIR-7316pdf
And
Conrad, Eric; Misenar, Seth; Feldman, Joshua (2012-09-01). CISSP Study Guide (Kindle
Locations 651-652). Elsevier Science (reference). Kindle Edition.
NEW QUESTION 97
The IAB defines which of the following as a violation of ethics?
- A. Creating a virus
- B. Performing a DoS
- C. Performing a penetration test
- D. Downloading an active control
- E. Disrupting Internet communications
Answer: E
Explanation:
The IAB considers the Internet a privilege, not a right, and as such considers it unethical to purposely disrupt communications.
NEW QUESTION 98
In the Capability Maturity Model (CMM) for software, the definition describes the range of expected results that can be achieved by following a software process is that of:
- A. Software process capability
- B. Structured analysis/structured design (SA/SD)
- C. Software process maturity
- D. Software process performance
Answer: A
Explanation:
A software process is a set of activities, methods, and practices that are
used to develop and maintain software and associated products.
Software process capability is a means of predicting the outcome of the next
software project conducted by an organization.
* Answer software process performance, is the result achieved by following a software process. Thus, software capability is aimed at expected results while software performance is focused on results that have been achieved. *Software process maturity is the extent to which a software process is: Defined Managed Measured Controlled Effective Software process maturity, then, provides for the potential for growth in capability of an organization. An immature organization develops software in a crisis mode, usually exceeds budgets and time schedules, and software processes are developed in an ad hoc fashion during the project. In a mature organization, the software process is effectively communicated to staff, the required processes are documented and consistent, software quality is evaluated, and roles and responsibilities are understood for the project. Answer SA/SD is a distracter.
NEW QUESTION 99
Which one of the following risk analysis terms characterizes the absence or weakness of a risk-reducing safegaurd?
- A. Loss expectancy
- B. Vulnerability
- C. Threat
- D. Probability
Answer: B
Explanation:
A weakness in system security procedures, system design, implementation, internal controls, and so on that could be exploited to violate system security policy. -Ronald Krutz The CISSP PREP Guide (gold edition) pg 927
NEW QUESTION 100
Employers often advocate on behalf of their employees in benefit disputes and appeals, answer questions with regard to the health plan, and generally help them navigate their health benefits. Is individual consent required?
- A. Sometimes
- B. No
- C. Yes
- D. The answer is indeterminate
Answer: C
NEW QUESTION 101
The OSI model contains seven layers. TCP/IP is generally accepted as having how many layers?
- A. five
- B. eight
- C. six
- D. four
Answer: D
Explanation:
The TCP/IP Protocol Model is similar to the OSI model, but it defines only the following four layers instead of seven: Application Layer, Host-to-Host Transport Layer, Internet Layer, Network Access or Link Layer. Pg. 84 Krutz: The CISSP Prep Guide.
NEW QUESTION 102
......
ISC CISSP Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
CISSP certification guide Q&A from Training Expert PrepPDF: https://www.preppdf.com/ISC/CISSP-prepaway-exam-dumps.html
CISSP Certification Overview Latest CISSP PDF Dumps: https://drive.google.com/open?id=15GyM1H6duJev3l2byEESvw3E96QIHwvm