Use Real CISSP - 100% Cover Real Exam Questions [Jul-2022]
Dumps Brief Outline Of The CISSP Exam - Exam4Docs
The Certified Information Systems Security Professional (CISSP) certification exam is intended for IT specialists who seek to build skills in identifying the IT infrastructure and planning, developing, and managing a secure business climate using internationally approved information security principles. The related certificate was introduced in 1994 and is named as the most required security designation on LinkedIn. The CISSP is the first security certification to meet the strict terms and conditions of ISO/IEC Standard 17024. Besides, the CISSP endorsement includes cloud computing security best practices. It indicates that you have the specialized experience and technological expertise to plan, improve, and maintain the overall security role of the company. Moreover, the CISSP qualification is most suited for security managers, security analysts, chief information security officers, directors of security, and other IT security roles.
ISC2 CISSP Exam Certification Details:
| Number of Questions | 100-150 |
| Sample Questions | ISC2 CISSP Sample Questions |
| Passing Score | 700/1000 |
| Exam Name | ISC2 Certified Information Systems Security Professional (CISSP) |
| Duration | 180 mins |
Introduction of ISC Certification
The CISSP certification was developed by the International Information Systems Security Certification Consortium (ISC) and is widely considered one of the most difficult certifications to attain. The CISSP exam tests for knowledge of concepts such as network security, software security, cryptography, physical security, and general security principles. Candidates must pass a rigorous 8-hour long exam and demonstrate proficiency in at least 10 out of 12 knowledge areas. Are worried about the study material for the exam? Keep calm, I have the solution. That solution is CISSP Dumps, that will guide and help in study for the CISSP exam.
NEW QUESTION 143
For competitive reasons, the customers of a large shipping company called the "Integrated International Secure Shipping Containers Corporation" (IISSCC) like to keep private the various cargos that they ship. IISSCC uses a secure database system based on the Bell-LaPadula access control model to keep this information private. Different information in this database is classified at different levels. For example, the time and date a ship departs is labeled Unclassified, so customers can estimate when their cargos will arrive, but the contents of all shipping containers on the ship are labeled Top Secret to keep different shippers from viewing each other's cargos.
An unscrupulous fruit shipper, the "Association of Private Fuit Exporters, Limited" (APFEL) wants to learn whether or not a competitor, the "Fruit Is Good Corporation" (FIGCO), is shipping pineapples on the ship "S.S. Cruise Pacific" (S.S. CP). APFEL can't simply read the top secret contents in the IISSCC database because of the access model. A smart APFEL worker, however, attempts to insert a false, unclassified record in the database that says that FIGCO is shipping pineapples on the S.S. CP, reasoning that if there is already a FIGCO-pineapple-SSCP record then the insertion attempt will fail. But the attempt does not fail, so APFEL can't be sure whether or not FIGCO is shipping pineapples on the S.S. CP.
What is the name of the access control model property that prevented APFEL from reading FIGCO's cargo information? What is a secure database technique that could explain why, when the insertion attempt succeeded, APFEL was still unsure whether or not FIGCO was shipping pineapples?
- A. Simple Security Property and Polyinstantiation
- B. *-Property and Polymorphism
- C. Strong *-Property and Polyinstantiation
- D. Simple Security Property and Polymorphism
Answer: A
Explanation:
The Simple Security Property states that a subject at a given clearance may not
read an object at a higher classification, so unclassified APFEL could not read FIGCO's top secret
cargo information.
Polyinstantiation permits a database to have two records that are identical except for their
classifications (i.e., the primary key includes the classification). Thus, APFEL's new unclassified
record did not collide with the real, top secret record, so APFEL was not able to learn about FIGs
pineapples.
The following answers are incorrect:
*-Property and Polymorphism
The *-property states that a subject at a given clearance must not write to any object at a lower
classification, which is irrelevant here because APFEL was trying to read data with a higher
classification.
Polymorphism is a term that can refer to, among other things, viruses that can change their code
to better hide from anti-virus programs or to objects of different types in an object-oriented
program that are related by a common superclass and can, therefore, respond to a common set of
methods in different ways. That's also irrelevant to this question.
Strong *-Property and Polyinstantiation
Half-right. The strong *-property limits a subject of a given clearance to writing only to objects with
a matching classification. APFEL's attempt to insert an unclassified record was consistent with this
property, but that has nothing to do with preventing APFEL from reading top secret information.
Simple Security Property and Polymorphism
Also half-right. See above for why Polymorphism is wrong.
The following reference(s) were/was used to create this question:
HARRIS, Shon, CISSP All-in-one Exam Guide, Third Edition, McGraw-Hill/Osborne, 2005
Chapter 5: Security Models and Architecture (page 280)
Chapter 11: Application and System Development (page 828)
NEW QUESTION 144
When logging on to a workstation, the log-on process should:
- A. Place no limits on the time allotted for log-on or on the number of
unsuccessful log-on attempts. - B. Not provide information on the previous successful log-on and on
previous unsuccessful log-on attempts. - C. Validate the log-on only after all input data has been supplied.
- D. Provide a Help mechanism that provides log-on assistance.
Answer: C
Explanation:
This approach is necessary to ensure that all the information required
for a log-on has been submitted and to avoid providing information
that would aid a cracker in trying to gain unauthorized access to the
workstation or network. If a log-on attempt fails, information as to
which part of the requested log-on information was incorrect should
not be supplied to the user.
Answer "Provide a Help mechanism that provides log-on assistance" is incorrect since a
Help utility
would provide help to a cracker trying to gain unauthorized access to
the network.
For answer "Place no limits on the time allotted for log-on or on the number of unsuccessful log-on attempts", maximum and minimum time limits should be placed on the log-on process. Also, the log-on process should limit
the number of unsuccessful log-on attempts and temporarily suspend
the log-on capability if that number is exceeded. One approach is to
progressively increase the time interval allowed between unsuccessful
log-on attempts.
Answer "Not provide information on the previous successful log-on and on previous unsuccessful log-on attempts" is incorrect since providing such information will alert an authorized user if someone has been attempting to gain unauthorized access to the network from the user's workstation.
NEW QUESTION 145
The primary service provided by Kerberos is which of the following?
- A. confidentiality
- B. non-repudiation
- C. authentication
- D. authorization
Answer: C
Explanation:
non-repudiation. Since Kerberos deals primarily with symmetric cryptography, it does not help with non-repudiation.
confidentiality. Once the client is authenticated by Kerberos and obtains its session key and ticket, it may use them to assure confidentiality of its communication with a server; however, that is not a Kerberos service as such.
authorization. Although Kerberos tickets may include some authorization information, the meaning of the authorization fields is not standardized in the Kerberos specifications, and authorization is not a primary Kerberos service.
The following reference(s) were/was used to create this question:
ISC2 OIG,2007 p. 179-184
Shon Harris AIO v.3 152-155
NEW QUESTION 146
Public key infrastructure(PKI) consists of programs, data formats, procedures, communication protocols, security policies, and public key cryptographic mechanisms working in a comprehensive manner to enable a wide range of dispersed people to communicate in a secure and predictable fashion.
This infrastructure is based upon which of the following Standard?
- A. X.500
- B. X.25
- C. X.509
- D. X.400
Answer: C
Explanation:
X.509 was initially issued on July 3, 1988 and was begun in association with the X.500 standard.
It assumes a strict hierarchical system of certificate authorities (CAs) for issuing the certificates. This contrasts with web of trust models, like PGP, where anyone (not just special CAs) may sign and thus attest to the validity of others' key certificates.
PKI establishes a level of trust within an environment.
PKI is an ISO authentication framework that uses public key cryptography and the X.509 standard.
The framework was set up to enable authentication to happen across different networks and the Internet.
Particular protocols and algorithms are not specified, which is why PKI is called a framework and not a specific technology.
In cryptography, X.509 is an ITU-T standard for a public key infrastructure (PKI) and
Privilege Management Infrastructure (PMI). X.509 specifies, amongst other things, standard formats for public key certificates, certificate revocation lists, attribute certificates, and a certification path validation algorithm.
The standard for how the CA creates the certificate is X.509, which dictates the different fields used in the certificate and the valid values that can populate those fields.
The most commonly used version is v3 of this standard, which is often denoted as
X.509v3.
Many cryptographic protocols use this type of certificate, including SSL.
The certificate includes the serial number, version number, identity information, algorithm information, lifetime dates, and the signature of the issuing authority
The following answers are incorrect:
X.500 is a Directory Access Protocol(LDAP)
X.400 is for Electronic Messaging (EMAILs)
X.25 is Frame Relay
The following reference(s) were/was used to create this question:
Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 833). McGraw-
Hill . Kindle Edition.
NEW QUESTION 147
Which of the following are the three classifications of RAID identified by the RAID Advisory Board?
- A. Failure Resistant Disk Systems (FRDSs), Failure Tolerant Disk Systems, and Disaster Tolerant Disk Systems.
- B. Federal Resistant Disk Systems (FRDSs), Fault Tolerant Disk Systems, and Disaster Tolerant Disk Systems.
- C. Foreign Resistant Disk Systems (FRDSs), Failure Tolerant Disk Systems, and Disaster Tolerant Disk Systems.
- D. Failure Resistant Disk Systems (FRDSs), File Transfer Disk Systems, and Disaster Tolerant Disk Systems.
Answer: A
Explanation:
The RAID Advisory Board has defined three classifications of RAID: Failure Resistant Disk Systems (FRDSs), Failure Tolerant Disk Systems, and Disaster Tolerant Disk Systems. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 65.
NEW QUESTION 148
Which of the following threats exists with an implementation of digital signatures?
- A. Spoofing
- B. Content tampering
- C. Eavesdropping
- D. Substitution
Answer: C
NEW QUESTION 149
The basic function of an FRDS is to?
- A. Persistent file servers from data gain and a gain of availability due to disk failure.
- B. Prudent file servers from data loss and a loss of acceptability due to disk failure.
- C. Protect file servers from data loss and a loss of availability due to disk failure.
- D. Packet file servers from data loss and a loss of accountability due to disk failure.
Answer: C
Explanation:
FRDS systems will give us the functionality to protect our servers from disk failure an allow us to have highly available file services in our production servers. FRDS provides high availability against many types of disk failures and well known problems, if one disk goes down, the others still work providing no downtime. FRDS solutions are the preferred way to protect file servers against data corruption and loss. You can see more about FRDS in the Internet, search "FRDS System".
NEW QUESTION 150
An organization publishes and periodically updates its employee policies in a file on their intranet.
Which of the following is a PRIMARY security concern?
- A. Integrity
- B. Availability
- C. Confidentiality
- D. Ownership
Answer: B
NEW QUESTION 151
Which of the following BEST describes a rogue Access Point (AP)?
- A. An AP infected by any kind of Trojan or Malware
- B. An AP connected to the wired infrastructure but not under the management of authorized network administrators
- C. An AP not configured to use Wired Equivalent Privacy (WEP) with Triple Data Encryption Algorithm (3DES)
- D. An AP that is not protected by a firewall
Answer: B
NEW QUESTION 152
What is the MOST significant benefit of role-based access control (RBAC)?
- A. Most granular form of access control
- B. Management of least privilege
- C. Reduces inappropriate access
- D. Reduction in authorization administration overhead
Answer: D
NEW QUESTION 153
Which of the following answers is the BEST example of Risk Transference?
- A. Results of Cost Benefit Analysis
- B. Acceptance
- C. Not hosting the services at all
- D. Insurance
Answer: D
Explanation:
When we operate an organizational information system we are accepting a tolerable level of risk to allow the business functions to operate.
There may be risks you are not qualified to accept or risks you would be better off having undertaken by an outside entity.
A classic example is having your popular web server hosted by a web hosting agency which completely relieves you of the risks associated with that.
Another example is insurance where you offload the risk to an insurance agency and pay them to accept the risk.
When we transfer risk we are giving the risk to someone else to accept and it could be for a number of reasons. Expense primarily but it could also be performance, offers of better service elsewhere, legal reasons and other reasons.
The following answers are incorrect:
-Results of Cost Benefit Analysis: This might be involved in the process of Risk Mitigation but it isn't part of Risk Transference. Sorry, wrong answer.
-Acceptance: This isn't correct because accepting the risk is the opposite of transferring the risk to someone else.
-Not hosting the services at all: Sorry, this defines Risk Avoidance.
The following reference(s) was used to create this question: 2013. Official Security+ Curriculum.
NEW QUESTION 154
Which security service is served by the process of encryption plaintext with the sender's private key and decrypting cipher text with the sender's public key?
- A. Availability
- B. Integrity
- C. Identification
- D. Confidentiality
Answer: C
Explanation:
Section: Security Architecture and Engineering
Explanation:
Only the person having correspondent private key can encrypt the plaintext decrypted (verified) by the public key, so proper identification of the endpoints are maintained.
NEW QUESTION 155
What is a neural network?
- A. A hardware or software system that emulates the reasoning of a human expert
- B. A series of networked PCs performing artificial intelligence tasks
- C. A hardware or software system that emulates the functioning of biological neurons
- D. A collection of computers that are focused on medical applications
Answer: C
Explanation:
A neural network is a hardware or software
system that emulates the functioning of biological neurons.
Answer "A hardware or software system that emulates the reasoning of a human expert" refers to an expert system. The other answers are distracters.
NEW QUESTION 156
Which of the following biometrics devices has the highest Crossover Error Rate (CER)?
- A. Fingerprints
- B. Voice pattern
- C. Hand geometry
- D. Iris scan
Answer: B
Explanation:
The Crossover Error Rate (CER) is the point where false rejection rate (type I error) equals the false acceptance rate (type II error). The lower the CER, the better the accuracy of the device. At the time if this writing, response times and accuracy of some devices are:
System type Response time Accuracy (CER)
Fingerprints 5-7 secs. 5%
Hand Geometry 3-5 secs. 2%
Voice Pattern 10-14 secs. 10%
Retina Scan 4-7 secs. 15%
Iris Scan 25-4 secs. 05%
The term EER which means Equal Error Rate is sometimes use instead of the term CER. It has the same meaning.
Source: Chris Hare's CISSP Study Notes on Physical Security, based on ISC2 CBK document. Available at http://www.ccure.org.
NEW QUESTION 157
Which of the following represents an ALE calculation?
- A. Singe loss expectancy x annualized rate of occurrence.
- B. Actual replacement cost - proceeds of salvage.
- C. Asset value x loss expectancy.
- D. Gross loss expectancy x loss frequency.
Answer: A
Explanation:
ALE (Annualized Loss Expectancy) calculations are a component of every risk analysis process. ALE calculations when done properly portray risk accurately. ALE calculations provide meaningful cost/benefit analysis. ALE calculations are used to: SLE x ARO = ALE
NEW QUESTION 158
Which Orange book security rating introduces security labels?
- A. C2
- B. B1
- C. B3
- D. B2
Answer: B
Explanation:
B1 is also called "Labeled Security" and each data object must have a classification
label and each subject a clearence label. On each access attempt, the classification and clearence
are checked to verify that the access is permissable.
C2 is incorrect. C2 is also called "Controlled Access Protection" and only requires that subjects be
individually identified and that security-related events are auditable.
B2 is incorrect. B2 is also called "Structured Protection" and imposes additional controls on
security policy and a more thorough review of system design and implementation.
B3 is incorrect. B3 is also called "Security Domains" and and imposes more granularity in each
protection mechanism.
References:
CBK, pp. 329 - 330
AIO3 pp.302 - 307
NEW QUESTION 159
......
Certification Training for CISSP Exam Dumps Test Engine: https://www.exam4docs.com/CISSP-study-questions.html
CISSP Training & Certification Get Latest ISC Certification : https://drive.google.com/open?id=1zrM4TZb0dHaQSw3jUnue99Z8PphTTqKt
