ISC CSSLP Online Practice Questions and Exam Preparation

ISC CSSLP Online Questions & Answers

• Question 221:

  The Web resource collection is a security constraint element summarized in the Java Servlet Specification v2.4. Which of the following elements does it include? Each correct answer represents a complete solution. Choose two.

  A. HTTP methods
  B. Role names
  C. Transport guarantees
  D. URL patterns
  A. HTTP methods
  D. URL patterns

  ---

  Web resource collection is a set of URL patterns and HTTP operations that define all resources required to be protected. It is a security constraint element summarized in the Java Servlet Specification v2.4. The Web resource collection

  includes the following elements: URL patterns HTTP methods Answer: B is incorrect. An authorization constraint includes role names. Answer:

  C is incorrect. A user data constraint includes transport guarantees.

• Question 222:

  The Project Risk Management knowledge area focuses on which of the following processes? Each correct answer represents a complete solution. Choose all that apply.

  A. Risk Monitoring and Control
  B. Risk Management Planning
  C. Quantitative Risk Analysis
  D. Potential Risk Monitoring
  A. Risk Monitoring and Control
  B. Risk Management Planning
  C. Quantitative Risk Analysis

  ---

  The Project Risk Management knowledge area focuses on the following processes:

  Risk Management Planning Risk Identification Qualitative Risk Analysis Quantitative Risk Analysis Risk Response Planning Risk Monitoring and Control Answer: D is incorrect. There is no such process in the Project Risk Management

  knowledge area.

• Question 223:

  What are the differences between managed and unmanaged code technologies? Each correct answer represents a complete solution. Choose two.

  A. Managed code is referred to as Hex code, whereas unmanaged code is referred to as byte code.
  B. C and C++ are the examples of managed code, whereas Java EE and Microsoft.NET are the examples of unmanaged code.
  C. Managed code executes under management of a runtime environment, whereas unmanaged code is executed by the CPU of a computer system.
  D. Managed code is compiled into an intermediate code format, whereas unmanaged code is compiled into machine code.
  C. Managed code executes under management of a runtime environment, whereas unmanaged code is executed by the CPU of a computer system.
  D. Managed code is compiled into an intermediate code format, whereas unmanaged code is compiled into machine code.

  ---

  Programming languages are categorized into two technologies: 1.Managed code:

  This computer program code is compiled into an intermediate code format. Managed code is referred to as byte code. It executes under the management of a runtime environment. Java EE and Microsoft.NET are the examples of managed

  code. 2.Unmanaged code: This computer code is compiled into machine code. Unmanaged code is executed by the CPU of a computer system. C and C++ are the examples of unmanaged code. Answer: A is incorrect. Managed code is

  referred to as byte code. Answer: B is incorrect. C and C++ are the examples of unmanaged code, whereas Java EE and Microsoft.NET are the examples of managed code.

• Question 224:

  Which of the following security design principles supports comprehensive and simple design and implementation of protection mechanisms, so that an unintended access path does not exist or can be readily identified and eliminated?

  A. Least privilege
  B. Economy of mechanism
  C. Psychological acceptability
  D. Separation of duties
  B. Economy of mechanism

  ---

  The economy of mechanism is a security design principle, which supports simple and comprehensive design and implementation of protection mechanisms, so that an unintended access path does not exist or can be readily identified and eliminated. Answer: D is incorrect. Separation of duties defines that the completion of a specific sensitivity activity or access to sensitive object depends on the satisfaction of multiple conditions. Answer: C is incorrect. Psychological acceptability defines the ease of use and intuitiveness of the user interface that controls and interacts with the access control mechanisms. Answer: A is incorrect. Least privilege maintains that an individual, process, or other type of entity should be given the minimum privileges and resources for the minimum period of time required to complete a task.

• Question 225:

  Which of the following statements reflect the 'Code of Ethics Canons' in the '(ISC)2 Code of Ethics'? Each correct answer represents a complete solution. Choose all that apply.

  A. Act honorably, honestly, justly, responsibly, and legally.
  B. Give guidance for resolving good versus good and bad versus bad dilemmas.
  C. Provide diligent and competent service to principals.
  D. Protect society, the commonwealth, and the infrastructure.
  A. Act honorably, honestly, justly, responsibly, and legally.
  C. Provide diligent and competent service to principals.
  D. Protect society, the commonwealth, and the infrastructure.

  ---

  The Code of Ethics Canons in (ISC)2 code of ethics are as follows: Protect society, the commonwealth, and the infrastructure. Act honorably, honestly, justly, responsibly, and legally. Provide diligent and competent service to principals. Advance and protect the profession.

• Question 226:

  Which of the following security models dictates that subjects can only access objects through applications?

  A. Biba model
  B. Bell-LaPadula
  C. Clark-Wilson
  D. Biba-Clark model
  C. Clark-Wilson

  ---

  The Clark-Wilson security model dictates that subjects can only access objects through applications. Answer: A is incorrect. The Biba model does not let subjects write to objects at a higher integrity level. Answer: B is incorrect. The Bell-LaPadula model has a simple security rule, which means a subject cannot read data from a higher level. Answer: D is incorrect. There is no such model as Biba-Clark model.

• Question 227:

  The service-oriented modeling framework (SOMF) provides a common modeling notation to address alignment between business and IT organizations. Which of the following principles does the SOMF concentrate on? Each correct answer represents a part of the solution. Choose all that apply.

  A. Architectural components abstraction
  B. SOA value proposition
  C. Business traceability
  D. Disaster recovery planning
  E. Software assets reuse
  A. Architectural components abstraction
  B. SOA value proposition
  C. Business traceability
  E. Software assets reuse

  ---

  The service-oriented modeling framework (SOMF) concentrates on the following principles:

  Business traceability Architectural best-practices traceability Technological traceability SOA value proposition Software assets reuse SOA integration strategies Technological abstraction and generalization Architectural components

  abstraction Answer: D is incorrect. The service- oriented modeling framework (SOMF) does not concentrate on it.

• Question 228:

  Which of the following phases of the DITSCAP CandA process is used to define the CandA level of effort, to identify the main CandA roles and responsibilities, and to create an agreement on the method for implementing the security requirements?

  A. Phase 1
  B. Phase 4
  C. Phase 2
  D. Phase 3
  A. Phase 1

  ---

  The Phase 1 of the DITSCAP CandA process is known as Definition Phase. The goal of this phase is to define the CandA level of effort, identify the main CandA roles and responsibilities, and create an agreement on the method for implementing the security requirements. Answer: C is incorrect. The Phase 2 of the DITSCAP CandA process is known as Verification. Answer: D is incorrect. The Phase 3 of the DITSCAP CandA process is known as Validation. Answer: B is incorrect. The Phase 4 of the DITSCAP CandA process is known as Post Accreditation.

• Question 229:

  Which of the following governance bodies provides management, operational and technical controls to satisfy security requirements?

  A. Senior Management
  B. Business Unit Manager
  C. Information Security Steering Committee
  D. Chief Information Security Officer
  A. Senior Management

  ---

  Senior management provides management, operational and technical controls to satisfy security requirements. The governance roles and responsibilities are mentioned below in the table:

  

• Question 230:

  Part of your change management plan details what should happen in the change control system for your project. Theresa, a junior project manager, asks what the configuration management activities are for scope changes. You tell her that all of the following are valid configuration management activities except for which one?

  A. Configuration Identification
  B. Configuration Verification and Auditing
  C. Configuration Status Accounting
  D. Configuration Item Costing
  D. Configuration Item Costing

  ---

  Configuration item cost is not a valid activity for configuration management. Cost changes are managed by the cost change control system; configuration management is concerned with changes to the features and functions of the project deliverables.