CheckPoint CheckPoint Certification 156-110 Questions & Answers

• Question 41:

  The items listed below are examples of ___________________ controls.

  *Smart cards *Access control lists *Authentication servers *Auditing

  A. Role-based

  B. Administrative

  C. Technical

  D. Physical

  E. Mandatory

  Correct Answer: C

• Question 42:

  To protect its information assets, ABC Company purchases a safeguard that costs $60,000. The annual cost to maintain the safeguard is estimated to be $40,000. The aggregate Annualized Loss Expectancy for the risks the safeguard is expected to mitigate is $50,000. At this rate of return, how long will it take ABC Company to recoup the cost of the safeguard?

  A. ABC Company will never recoup the cost of this safeguard.

  B. Less than 7 years

  C. Less than 3 years

  D. Less than 1 year

  E. Less than 5 years

  Correct Answer: B

• Question 43:

  Organizations _______ risk, when they convince another entity to assume the risk for them.

  A. Elevate

  B. Assume

  C. Deny

  D. Transfer

  E. Mitigate

  Correct Answer: D

• Question 44:

  A(n) _______________ is an unintended communication path that can be used to violate a system security policy.

  A. Covert channel

  B. Integrity axiom

  C. Simple rule violation

  D. Inferred fact

  E. Aggregated data set

  Correct Answer: A

• Question 45:

  ____________________ educate(s) security administrators and end users about organizations' security policies.

  A. Security-awareness training

  B. Information Security (INFOSEC) briefings

  C. Acceptable-use policies

  D. Continuing education

  E. Nondisclosure agreements

  Correct Answer: A

• Question 46:

  Operating-system fingerprinting uses all of the following, EXCEPT ________, to identify a target operating system.

  A. Sequence Verifier

  B. Initial sequence number

  C. Address spoofing

  D. Time to Live

  E. IP ID field

  Correct Answer: C

• Question 47:

  Which of the following is the BEST method for managing users in an enterprise?

  A. Enter user data in a spreadsheet.

  B. Implement centralized access control.

  C. Deploy Kerberos.

  D. Place them in a centralized Lightweight Directory Access Protocol.

  E. Use a Domain Name System.

  Correct Answer: D

• Question 48:

  You are considering purchasing a VPN solution to protect your organization's information assets. The solution you are reviewing uses RFC-compliant and open-standards encryption schemes. The vendor has submitted the system to a variety of recognized testing authorities. The vendor does not make the source code available to testing authorities. Does this solution adhere to the secure design principle of open design?

  A. No, because the software vendor could have changed the code after testing, which is not verifiable.

  B. No, because the software vendor submitted the software to testing authorities only, and did not make the software available to the public for testing.

  C. Yes, because the methods were tested by recognized testing authorities, and the source code is protected from vandalism.

  D. Yes, because the methods are open, and the system does not rely on the secrecy of its internal mechanisms to provide protection.

  E. No, because if a software vendor refuses to reveal the source code for a product, it cannot comply with the open-design principle.

  Correct Answer: D

• Question 49:

  ____________________ is the state of being correct, or the degree of certainty a person or process can have, that the data in an information asset is correct.

  A. Confidentiality

  B. Integrity

  C. Authenticity

  D. Privacy

  E. Availability

  Correct Answer: B

• Question 50:

  Distinguish between the role of the data owner and the role of the data custodian. Complete the following sentence. The data owner is the:

  A. department in the organization responsible for the data's physical storage location. The data custodian is anyone who has access the data for any reason.

  B. person or entity who accesses/and or manipulates data or information, in the course of assigned duties. The data custodian is a person or process with the appropriate level of privilege to access the data.

  C. person or entity ultimately responsible for the security of an information asset. The data custodian is the person or entity responsible for imposing and enforcing policies and restrictions, dictated by the data owner.

  D. person or process that originally creates the information. The data custodian is a role that shifts to any person or process currently accessing the data, and passes to the next person or process to access the data.

  E. person or entity responsible for imposing and enforcing policies and restrictions, dictated by the functional user. The data custodian is a person or process who accesses and/or manipulates the information.

  Correct Answer: C