ISC CSSLP Online Practice Questions and Exam Preparation

ISC CSSLP Online Questions & Answers

• Question 101:

  In which of the following levels of exception safety are operations succeeded with full guarantee and fulfill all needs in the presence of exceptional situations?

  A. Commit or rollback semantics
  B. Minimal exception safety
  C. Failure transparency
  D. Basic exception safety
  C. Failure transparency

  ---

  Failure transparency is the best level of exception safety. In this level, operations are succeeded with full guarantee and fulfill all needs in the presence of exceptional situations. Failure transparency does not throw the exception further up even when an exception occurs. This level is also known as no throw guarantee.

• Question 102:

  Which of the following are the principle duties performed by the BIOS during POST (power-on- self-test)? Each correct answer represents a part of the solution. Choose all that apply.

  A. It provides a user interface for system's configuration.
  B. It identifies, organizes, and selects boot devices.
  C. It delegates control to other BIOS, if it is required.
  D. It discovers size and verifies system memory.
  E. It verifies the integrity of the BIOS code itself.
  F. It interrupts the execution of all running programs.
  A. It provides a user interface for system's configuration.
  B. It identifies, organizes, and selects boot devices.
  C. It delegates control to other BIOS, if it is required.
  D. It discovers size and verifies system memory.
  E. It verifies the integrity of the BIOS code itself.

  ---

  The principle duties performed by the BIOS during POST (power-on-self-test) are as follows: It verifies the integrity of the BIOS code itself. It discovers size and verifies system memory. It discovers, initializes, and catalogs all system hardware. It delegates control to other BIOS if it is required. It provides a user interface for system's configuration. It identifies, organizes, and selects boot devices. It executes the bootstrap program. Answer: F is incorrect. The BIOS does not interrupt the execution of all running programs.

• Question 103:

  "Enhancing the Development Life Cycle to Produce Secure Software" summarizes the tools and practices that are helpful in producing secure software. What are these tools and practices? Each correct answer represents a complete solution. Choose three.

  A. Leverage attack patterns
  B. Compiler security checking and enforcement
  C. Tools to detect memory violations
  D. Safe software libraries E. Code for reuse and maintainability
  B. Compiler security checking and enforcement
  C. Tools to detect memory violations
  D. Safe software libraries E. Code for reuse and maintainability

  ---

  The tools and practices that are helpful in producing secure software are summarized in the report "Enhancing the Development Life Cycle to Produce Secure Software". The tools and practices are as follows: Compiler security checking and enforcement Safe software libraries Runtime error checking and safety enforcement Tools to detect memory violations Code obfuscation Answer: A and E are incorrect. These are secure coding principles and practices of defensive coding.

• Question 104:

  You work as a system engineer for BlueWell Inc. You want to verify that the build meets its data requirements, and correctly generates each expected display and report. Which of the following tests will help you to perform the above task?

  A. Performance test
  B. Functional test
  C. Reliability test
  D. Regression test
  B. Functional test

  ---

  The various types of internal tests performed on builds are as follows: Regression tests: It is also known as the verification testing. These tests are developed to confirm that capabilities in earlier builds continue to work correctly in the

  subsequent builds. Functional test:

  These tests emphasizes on verifying that the build meets its functional and data requirements and correctly generates each expected display and report. Performance tests: These tests are used to identify the performance thresholds of each

  build. Reliability tests: These tests are used to identify the reliability thresholds of each build.

• Question 105:

  Shoulder surfing is a type of in-person attack in which the attacker gathers information about the premises of an organization. This attack is often performed by looking surreptitiously at the keyboard of an employee's computer while he is typing in his password at any access point such as a terminal/Web site. Which of the following is violated in a shoulder surfing attack?

  A. Integrity
  B. Availability
  C. Confidentiality
  D. Authenticity
  C. Confidentiality

  ---

  Confidentiality is violated in a shoulder surfing attack. The CIA triad provides the following three tenets for which security practices are measured: Confidentiality: It is the property of preventing disclosure of information to unauthorized individuals or systems. Breaches of confidentiality take many forms. Permitting someone to look over your shoulder at your computer screen while you have confidential data displayed on it could be a breach of confidentiality. If a laptop computer containing sensitive information about a company's employees is stolen or sold, it could result in a breach of confidentiality. Integrity: It means that data cannot be modified without authorization. Integrity is violated when an employee accidentally or with malicious intent deletes important data files, when a computer virus infects a computer, when an employee is able to modify his own salary in a payroll database, when an unauthorized user vandalizes a web site, when someone is able to cast a very large number of votes in an online poll, and so on. Availability: It means that data must be available at every time when it is needed. Answer: D is incorrect. Authenticity is not a tenet of the CIA triad.

• Question 106:

  NIST SP 800-53A defines three types of interview depending on the level of assessment conducted. Which of the following NIST SP 800-53A interviews consists of informal and ad hoc interviews?

  A. Comprehensive
  B. Significant
  C. Abbreviated
  D. Substantial
  C. Abbreviated

  ---

  Abbreviated interview consists of informal and ad hoc interviews. Answer: D is incorrect. Substantial interview consists of informal and structured interviews. Answer: A is incorrect. Comprehensive interview consists of formal and structured interviews. Answer: B is incorrect. There is no such type of interview in NIST SP 800-53A.

• Question 107:

  Which of the following DoD policies establishes policies and assigns responsibilities to achieve DoD IA through a defense-in-depth approach that integrates the capabilities of personnel, operations, and technology, and supports the evolution to network-centric warfare?

  A. DoDI 5200.40
  B. DoD 8500.1 Information Assurance (IA)
  C. DoD 8510.1-M DITSCAP
  D. DoD 8500.2 Information Assurance Implementation
  B. DoD 8500.1 Information Assurance (IA)

  ---

  DoD 8500.1 Information Assurance (IA) sets up policies and allots responsibilities to achieve DoD IA through a defense-in-depth approach that integrates the capabilities of personnel, operations, and technology, and supports the evolution to network-centric warfare. DoD 8500.1 also summarizes the roles and responsibilities for the persons responsible for carrying out the IA policies. Answer: D is incorrect. The DoD 8500.2 Information Assurance Implementation pursues 8500.1. It provides assistance on how to implement policy, assigns responsibilities, and prescribes procedures for applying integrated, layered protection of the DoD information systems and networks. DoD Instruction 8500.2 allots tasks and sets procedures for applying integrated layered protection of the DOD information systems and networks in accordance with the DoD 8500.1 policy. It also provides some important guidelines on how to implement an IA program. Answer: A is incorrect. DoDI 5200.40 executes the policy, assigns responsibilities, and recommends procedures under reference for Certification and Accreditation(CandA) of information technology (IT). Answer: C is incorrect. DoD 8510.1-M DITSCAP provides standardized activities leading to accreditation, and establishes a process and management baseline.

• Question 108:

  What project management plan is most likely to direct the quantitative risk analysis process for a project in a matrix environment?

  A. Risk analysis plan
  B. Staffing management plan
  C. Risk management plan
  D. Human resource management plan
  C. Risk management plan

  ---

  The risk management plan defines how risks will be identified, analyzed, responded to, and then monitored and controlled regardless of the structure of the organization. Answer: D is incorrect. The human resources management plan does define how risks will be analyzed. Answer: B is incorrect. The staffing management plan does define how risks will be analyzed. Answer: A is incorrect. The risk analysis plan does define how risks will be analyzed.

• Question 109:

  Which of the following are the phases of the Certification and Accreditation (CandA) process? Each correct answer represents a complete solution. Choose two.

  A. Continuous Monitoring
  B. Auditing
  C. Detection
  D. Initiation
  A. Continuous Monitoring
  D. Initiation

  ---

  The Certification and Accreditation (CandA) process consists of four distinct phases:

  1.Initiation 2.Security Certification 3.Security Accreditation 4.Continuous Monitoring The CandA activities can be applied to an information system at appropriate phases in the system development life cycle by selectively tailoring the various

  tasks and subtasks. Answer: B and C are incorrect. Auditing and detection are not phases of the Certification and Accreditation process.

• Question 110:

  You work as a Security Manager for Tech Perfect Inc. You want to save all the data from the SQL injection attack, which can read sensitive data from the database and modify database data using some commands, such as Insert, Update, and Delete. Which of the following tasks will you perform? Each correct answer represents a complete solution. Choose three.

  A. Apply maximum number of database permissions.
  B. Use an encapsulated library for accessing databases.
  C. Create parameterized stored procedures.
  D. Create parameterized queries by using bound and typed parameters.
  B. Use an encapsulated library for accessing databases.
  C. Create parameterized stored procedures.
  D. Create parameterized queries by using bound and typed parameters.

  ---

  The methods of mitigating SQL injection attacks are as follows: 1.Create parameterized queries by using bound and typed parameters. 2.Create parameterized stored procedures. 3.Use a encapsulated library in order to access databases. 4.Minimize database permissions. Answer: A is incorrect. In order to save all the data from the SQL injection attack, you should minimize database permissions.