ISC CSSLP Online Practice Questions and Exam Preparation

ISC CSSLP Online Questions & Answers

• Question 281:

  Which of the following security issues does the Bell-La Padula model focus on?

  A. Authorization
  B. Confidentiality
  C. Integrity
  D. Authentication
  B. Confidentiality

  ---

  The Bell-La Padula model is a state machine model used for enforcing access control in large organizations. It focuses on data confidentiality and access to classified information, in contrast to the Biba Integrity model, which describes rules for the protection of data integrity. In the Bell-La Padula model, the entities in an information system are divided into subjects and objects. The Bell-La Padula model is built on the concept of a state machine with a set of allowable states in a computer network system. The transition from one state to another state is defined by transition functions. The model defines two mandatory access control (MAC) rules and one discretionary access control (DAC) rule with three security properties: 1.The Simple Security Property: A subject at a given security level may not read an object at a higher security level (no read-up). 2.The *-property (star-property): A subject at a given security level must not write to any object at a lower security level (no write-down). The *-property is also known as the Confinement property. 3.The Discretionary Security Property: It uses an access matrix to specify the discretionary access control.

• Question 282:

  You are responsible for network and information security at a large hospital. It is a significant concern that any change to any patient record can be easily traced back to the person who made that change. What is this called?

  A. Availability
  B. Confidentiality
  C. Non repudiation
  D. Data Protection
  C. Non repudiation

  ---

  Non repudiation refers to mechanisms that prevent a party from falsely denying involvement in some data transaction.

• Question 283:

  Which of the following types of obfuscation transformation increases the difficulty for a de- obfuscation tool so that it cannot extract the true application from the obfuscated version?

  A. Preventive transformation
  B. Data obfuscation
  C. Control obfuscation
  D. Layout obfuscation
  A. Preventive transformation

  ---

  Preventive transformation increases the difficulty for a de-obfuscation tool so that it cannot

• Question 284:

  Which of the following are the primary functions of configuration management?

  Each correct answer represents a complete solution. Choose all that apply.

  A. It removes the risk event entirely by adding additional steps to avoid the event.
  B. It ensures that the change is implemented in a sequential manner through formalized testing.
  C. It reduces the negative impact that the change might have had on the computing services and resources.
  D. It analyzes the effect of the change that is implemented on the system.
  B. It ensures that the change is implemented in a sequential manner through formalized testing.
  C. It reduces the negative impact that the change might have had on the computing services and resources.
  D. It analyzes the effect of the change that is implemented on the system.

  ---

  The primary functions of configuration management are as follows: It ensures that the change is implemented in a sequential manner through formalized testing. It ensures that the user base is informed of the future change. It analyzes the effect of the change that is implemented on the system. It reduces the negative impact that the change might have had on the computing services and resources. Answer: A is incorrect. It is not one of the primary functions of configuration management. It is the function of risk avoidance.

• Question 285:

  Drag and drop the appropriate external constructs in front of their respective functions.

  Select and Place:

  

  

  ---

  There are two types of compositional constructs: 1.External constructs: The various types of external constructs are as follows: Cascading: In this type of external construct, one system gains the input from the output of another system. Feedback: In this type of external construct, one system provides the input to another system, which in turn feeds back to the input of the first system. Hookup: In this type of external construct, one system communicates with another system as well as with external entities. 2.Internal constructs: The internal constructs include intersection, union, and difference.

• Question 286:

  Which of the following security architectures defines how to integrate widely disparate applications for a world that is Web-based and uses multiple implementation platforms?

  A. Sherwood Applied Business Security Architecture
  B. Enterprise architecture
  C. Service-oriented architecture
  D. Service-oriented modeling and architecture
  C. Service-oriented architecture

  ---

  In computing, a service-oriented architecture (SOA) is a flexible set of design principles used during the phases of systems development and integration. A deployed SOA- based architecture will provide a loosely-integrated suite of services that can be used within multiple business domains. SOA also generally provides a way for consumers of services, such as web-based applications, to be aware of available SOA-based services. For example, several disparate departments within a company may develop and deploy SOA services in different implementation languages; their respective clients will benefit from a well understood, well defined interface to access them. XML is commonly used for interfacing with SOA services, though this is not required. SOA defines how to integrate widely disparate applications for a world that is Web- based and uses multiple implementation platforms. Rather than defining an API, SOA defines the interface in terms of protocols and functionality. An endpoint is the entry point for such an SOA implementation.

  

  (Layer interaction in Service-oriented architecture) Answer: A is incorrect. SABSA (Sherwood Applied Business Security Architecture) is a framework and methodology for Enterprise Security Architecture and Service Management. SABSA is a model and a methodology for developing risk- driven enterprise information security architectures and for delivering security infrastructure solutions that support critical business initiatives. The primary characteristic of the SABSA model is that everything must be derived from an analysis of the business requirements for security, especially those in which security has an enabling function through which new business opportunities can be developed and exploited. Answer: D is incorrect. The service-oriented modeling and architecture (SOMA) includes an analysis and design method that extends traditional object-oriented and component-based analysis and design methods to include concerns relevant to and supporting SOA. Answer: B is incorrect. Enterprise architecture describes the terminology, the composition of subsystems, and their relationships with the external environment, and the guiding principles for the design and evolution of an enterprise.

• Question 287:

  The Phase 2 of DITSCAP CandA is known as Verification. The goal of this phase is to obtain a fully integrated system for certification testing and accreditation. What are the process activities of this phase? Each correct answer represents a complete solution. Choose all that apply.

  A. Certification analysis
  B. Assessment of the Analysis Results
  C. Configuring refinement of the SSAA
  D. System development
  E. Registration
  A. Certification analysis
  B. Assessment of the Analysis Results
  C. Configuring refinement of the SSAA
  D. System development

  ---

  The Phase 2 of DITSCAP CandA is known as Verification. The goal of this phase is to obtain a fully integrated system for certification testing and accreditation. This phase takes place between the signing of the initial version of the SSAA and the formal accreditation of the system. This phase verifies security requirements during system development. The process activities of this phase are as follows: Configuring refinement of the SSAA System development Certification analysis Assessment of the Analysis Results Answer: E is incorrect. Registration is a Phase 1 activity.

• Question 288:

  Which of the following roles is also known as the accreditor?

  A. Data owner
  B. Chief Risk Officer
  C. Chief Information Officer
  D. Designated Approving Authority
  D. Designated Approving Authority

  ---

  Designated Approving Authority (DAA) is also known as the accreditor. Answer: A is incorrect. The data owner (information owner) is usually a member of management, in charge of a specific business unit, and is ultimately responsible for the protection and use of a specific subset of information. Answer: B is incorrect. A Chief Risk Officer (CRO) is also known as Chief Risk Management Officer (CRMO). The Chief Risk Officer or Chief Risk Management Officer of a corporation is the executive accountable for enabling the efficient and effective governance of significant risks, and related opportunities, to a business and its various segments. Risks are commonly categorized as strategic, reputational, operational, financial, or compliance-related. CRO's are accountable to the Executive Committee and The Board for enabling the business to balance risk and reward. In more complex organizations, they are generally responsible for coordinating the organization's Enterprise Risk Management (ERM) approach. Answer: C is incorrect. The Chief Information Officer (CIO), or Information Technology (IT) director, is a job title commonly given to the most senior executive in an enterprise responsible for the information technology and computer systems that support enterprise goals. The CIO plays the role of a leader and reports to the chief executive officer, chief operations officer, or chief financial officer. In military organizations, they report to the commanding officer.

• Question 289:

  Which of the following types of redundancy prevents attacks in which an attacker can get physical control of a machine, insert unauthorized software, and alter data?

  A. Data redundancy
  B. Hardware redundancy
  C. Process redundancy
  D. Application redundancy
  C. Process redundancy

  ---

  Process redundancy permits software to run simultaneously on multiple geographically distributed locations, with voting on results. It prevents attacks in which an attacker can get physical control of a machine, insert unauthorized software, and alter data.

• Question 290:

  Which of the following types of attacks occurs when an attacker successfully inserts an intermediary software or program between two communicating hosts?

  A. Denial-of-service attack
  B. Dictionary attack
  C. Man-in-the-middle attack
  D. Password guessing attack
  C. Man-in-the-middle attack

  ---

  When an attacker successfully inserts an intermediary software or program between two