ISC CSSLP Online Practice Questions and Exam Preparation

ISC CSSLP Online Questions & Answers

• Question 181:

  Fill in the blank with the appropriate security mechanism. is a computer hardware mechanism or programming language construct which handles the occurrence of exceptional events.

  A. Exception handling
  A. Exception handling

  ---

  Exception handling is a computer hardware mechanism or programming language construct that handles the occurrence of events. These events occur during the software execution process and interrupt the instruction flow. Exception handling performs the specific activities for managing the exceptional events.

• Question 182:

  John works as a systems engineer for BlueWell Inc. He has modified the software, and wants to retest the application to ensure that bugs have been fixed or not. Which of the following tests should John use to accomplish the task?

  A. Reliability test
  B. Functional test
  C. Performance test
  D. Regression test
  D. Regression test

  ---

  John should use the regression tests to retest the application to guarantee that bugs have been fixed. This test will help him to check that the earlier working functions have not failed as a result of the changes, and newly added features have not created problems with the previous versions. The various types of internal tests performed on builds are as follows: Regression tests: It is also known as the verification testing. These tests are developed to confirm that capabilities in earlier builds continue to work correctly in the subsequent builds. Functional test: These tests emphasizes on verifying that the build meets its functional and data requirements and correctly generates each expected display and report. Performance tests: These tests are used to identify the performance thresholds of each build. Reliability tests: These tests are used to identify the reliability thresholds of each build.

• Question 183:

  Which of the following models uses a directed graph to specify the rights that a subject can transfer to an object or that a subject can take from another subject?

  A. Take-Grant Protection Model
  B. Biba Integrity Model
  C. Bell-LaPadula Model
  D. Access Matrix
  A. Take-Grant Protection Model

  ---

  The take-grant protection model is a formal model used in the field of computer security to establish or disprove the safety of a given computer system that follows specific rules. It shows that for specific systems the question of safety is decidable in linear time, which is in general undecidable. The model represents a system as directed graph, where vertices are either subjects or objects. The edges between them are labeled and the label indicates the rights that the source of the edge has over the destination. Two rights occur in every instance of the model: take and grant. They play a special role in the graph rewriting rules describing admissible changes of the graph. Answer: D is incorrect. The access matrix is a straightforward approach that provides access rights to subjects for objects. Answer: C is incorrect. The Bell-LaPadula model deals only with the confidentiality of classified material. It does not address integrity or availability. Answer: B is incorrect. The integrity model was developed as an analog to the Bell-LaPadula confidentiality model and then became more sophisticated to address additional integrity requirements.

• Question 184:

  What are the subordinate tasks of the Implement and Validate Assigned IA Control phase in the DIACAP process? Each correct answer represents a complete solution. Choose all that apply.

  A. Conduct validation activities.
  B. Execute and update IA implementation plan.
  C. Combine validation results in DIACAP scorecard.
  D. Conduct activities related to the disposition of the system data and objects.
  A. Conduct validation activities.
  B. Execute and update IA implementation plan.
  C. Combine validation results in DIACAP scorecard.

  ---

  The Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) is a process defined by the United States Department of Defense (DoD) for managing risk. The subordinate tasks of the Implement and Validate Assigned IA Control phase in the DIACAP process are as follows: Execute and update IA implementation plan. Conduct validation activities. Combine validation results in the DIACAP scorecard. Answer: D is incorrect. The activities related to the disposition of the system data and objects are conducted in the fifth phase of the DIACAP process. The fifth phase of the DIACAP process is known as Decommission System.

• Question 185:

  Which of the following are the types of access controls? Each correct answer represents a complete solution. Choose three.

  A. Physical
  B. Technical
  C. Administrative
  D. Automatic
  A. Physical
  B. Technical
  C. Administrative

  ---

  Security guards, locks on the gates, and alarms come under physical access control. Policies and procedures implemented by an organization come under administrative access control. IDS systems, encryption, network segmentation, and antivirus controls come under technical access control. Answer: D is incorrect. There is no such type of access control as automatic control.

• Question 186:

  Penetration tests are sometimes called white hat attacks because in a pen test, the good guys are attempting to break in. What are the different categories of penetration testing? Each correct answer represents a complete solution. Choose all that apply.

  A. Open-box
  B. Closed-box
  C. Zero-knowledge test
  D. Full-box
  E. Full-knowledge test
  F. Partial-knowledge test
  A. Open-box
  B. Closed-box
  C. Zero-knowledge test
  E. Full-knowledge test
  F. Partial-knowledge test

  ---

  The different categories of penetration testing are as follows: Open-box: In this category of penetration testing, testers have access to internal system code. This mode is basically suited for Unix or Linux. Closed-box: In this category of

  penetration testing, testers do not have access to closed systems. This method is good for closed systems. Zero-knowledge test: In this category of penetration testing, testers have to acquire information from scratch and they are not

  supplied with information concerning the IT system. Partial-knowledge test: In this category of penetration testing, testers have knowledge that may be applicable to a specific type of attack and associated vulnerabilities. Full-knowledge test:

  In this category of penetration testing, testers have massive knowledge concerning the information system to be evaluated. Answer: D is incorrect.

  There is no such category of penetration testing.

• Question 187:

  Which of the following steps of the LeGrand Vulnerability-Oriented Risk Management method determines the necessary compliance offered by risk management practices and assessment of risk levels?

  A. Assessment, monitoring, and assurance
  B. Vulnerability management
  C. Risk assessment
  D. Adherence to security standards and policies for development and deployment
  A. Assessment, monitoring, and assurance

  ---

  Assessment, monitoring, and assurance determines the necessary compliance that are offered by risk management practices and assessment of risk levels.

• Question 188:

  Martha registers a domain named Microsoft.in. She tries to sell it to Microsoft Corporation. The infringement of which of the following has she made?

  A. Copyright
  B. Trademark
  C. Patent
  D. Intellectual property
  B. Trademark

  ---

  According to the Lanham Act, domain names fall under trademarks law. A new section 43(d) of the Trademark Act (Lanham Act) states that anyone who in bad faith registers, traffics in, or uses a domain name that infringes or dilutes another's trademark has committed trademark infringement. Factors involved in assessing bad faith focus on activities typically associated with cyberpiracy or cybersquatting, such as whether the registrant has offered to sell the domain name to the trademark holder for financial gain without having used or intended to use it for a bona fide business; whether the domain-name registrant registered multiple domain names that are confusingly similar to the trademarks of others; and whether the trademark incorporated in the domain name is distinctive and famous. Other factors are whether the domain name consists of the legal name or common handle of the domain-name registrant and whether the domain- name registrant previously used the mark in connection with a bona fide business.

• Question 189:

  Which of the following configuration management system processes keeps track of the changes so that the latest acceptable configuration specifications are readily available?

  A. Configuration Control
  B. Configuration Status and Accounting
  C. Configuration Verification and Audit
  D. Configuration Identification
  B. Configuration Status and Accounting

  ---

  The configuration status accounting procedure is the ability to record and report on the configuration baselines associated with each configuration item at any moment of time. It supports the functional and physical attributes of software at various points in time, and performs systematic control of accounting to the identified attributes for the purpose of maintaining software integrity and traceability throughout the software development life cycle. The configuration status and accounting process keeps track of the changes so that the latest acceptable configuration specifications are readily available. Answer: C is incorrect. The verification and audit processes seek to establish a high level of confidence in how well the Configuration Management activity is working. Answer: A is incorrect. Configuration control is a procedure of the Configuration management. Configuration control is a set of processes and approval stages required to change a configuration item's attributes and to re-baseline them. It supports the change of the functional and physical attributes of software at various points in time, and performs systematic control of changes to the identified attributes. Answer: D is incorrect. Configuration identification is the process of identifying the attributes that define every aspect of a configuration item. A configuration item is a product (hardware and/or software) that has an end-user purpose. These attributes are recorded in configuration documentation and baselined. Baselining an attribute forces formal configuration change control processes to be effected in the event that these attributes are changed.

• Question 190:

  Which of the following features of SIEM products is used in analysis for identifying potential problems and reviewing all available data that are associated with the problems?

  A. Security knowledge base
  B. Graphical user interface
  C. Asset information storage and correlation
  D. Incident tracking and reporting
  B. Graphical user interface

  ---

  SIEM product has a graphical user interface (GUI) which is used in analysis for identifying potential problems and reviewing all available data that are associated with the problems. A graphical user interface (GUI) is a type of user interface that allows people to interact with programs in more ways than typing commands on computers. The term came into existence because the first interactive user interfaces to computers were not graphical; they were text- and- keyboard oriented and usually consisted of commands a user had to remember and computer responses that were infamously brief. A GUI offers graphical icons, and visual indicators, as opposed to text-based interfaces, typed command labels or text navigation to fully represent the information and actions available to a user. The actions are usually performed through direct manipulation of the graphical elements.