ISC CSSLP Online Practice Questions and Exam Preparation

ISC CSSLP Online Questions & Answers

• Question 301:

  You are the project manager of the NNN project for your company. You and the project team are working together to plan the risk responses for the project. You feel that the team has successfully completed the risk response planning and now you must initiate what risk process it is. Which of the following risk processes is repeated after the plan risk responses to determine if the overall project risk has been satisfactorily decreased?

  A. Quantitative risk analysis
  B. Risk identification
  C. Risk response implementation
  D. Qualitative risk analysis
  A. Quantitative risk analysis

  ---

  The quantitative risk analysis process is repeated after the plan risk responses to determine if the overall project risk has been satisfactorily decreased. Answer: D is incorrect. Qualitative risk analysis is not repeated after the plan risk response process. Answer: B is incorrect. Risk identification is an ongoing process that happens throughout the project. Answer: C is incorrect. Risk response implementation is not a project management process.

• Question 302:

  Which of the following rated systems of the Orange book has mandatory protection of the TCB?

  A. A-rated
  B. B-rated
  C. D-rated
  D. C-rated
  B. B-rated

  ---

  A B-rated system of the orange book has mandatory protection of the trusted computing base (TCB).

  Trusted computing base (TCB) refers to hardware, software, controls, and processes that cause a computer system or network to be devoid of malicious software or hardware. Maintaining the trusted computing base (TCB) is essential for

  security policy to be implemented successfully.

• Question 303:

  Martha works as a Project Leader for BlueWell Inc. She and her team have developed accounting software. The software was performing well. Recently, the software has been modified. The users of this software are now complaining about the software not working properly. Which of the following actions will she take to test the software?

  A. Perform integration testing
  B. Perform regression testing
  C. Perform unit testing
  D. Perform acceptance testing
  B. Perform regression testing

  ---

  Regression testing can be performed any time when a program needs to be modified either to add a feature or to fix an error. It is a process of repeating Unit testing and Integration testing whenever existing tests need to be performed again along with the new tests. Regression testing is performed to ensure that no existing errors reappear, and no new errors are introduced. Answer: D is incorrect. The acceptance testing is performed on the application before its implementation into the production environment. It is done either by a client or an application specialist to ensure that the software meets the requirement for which it was made. Answer: A is incorrect. Integration testing is a logical extension of unit testing. It is performed to identify the problems that occur when two or more units are combined into a component. During integration testing, a developer combines two units that have already been tested into a component, and the interface between the two units. Although integration testing can be performed in various ways, the following three approaches are generally used: The top-down approach The bottom-up approach The umbrella approach Answer: C is incorrect. Unit testing is a type of testing in which each independent unit of an application is tested separately. During unit testing, a developer takes the smallest unit of an application, isolates it from the rest of the application code, and tests it to determine whether it works as expected. Unit testing is performed before integrating these independent units into modules. The most common approach to unit testing requires drivers and stubs to be written. Drivers and stubs are programs. A driver simulates a calling unit, and a stub simulates a called unit.

• Question 304:

  Which of the following statements best describes the difference between the role of a data owner and the role of a data custodian?

  A. The custodian makes the initial information classification assignments, and the operations manager implements the scheme.
  B. The data owner implements the information classification scheme after the initial assignment by the custodian.
  C. The custodian implements the information classification scheme after the initial assignment by the operations manager.
  D. The data custodian implements the information classification scheme after the initial assignment by the data owner.
  D. The data custodian implements the information classification scheme after the initial assignment by the data owner.

  ---

  The data owner is responsible for ensuring that the appropriate security controls are in place, for assigning the initial classification to the data to be protected, for approving access requests from other parts of the organization, and for periodically reviewing the data classifications and access rights. Data owners are primarily responsible for determining the data's sensitivity or classification levels, whereas the data custodian has the responsibility for backup, retention, and recovery of data. The data owner delegates these responsibilities to the custodian. Answer: B, A, and C are incorrect. These are not the valid answers.

• Question 305:

  Which of the following cryptographic system services ensures that information will not be disclosed to any unauthorized person on a local network?

  A. Authentication
  B. Integrity
  C. Non-repudiation
  D. Confidentiality
  D. Confidentiality

  ---

  The confidentiality service of a cryptographic system ensures that information will not be disclosed to any unauthorized person on a local network.

• Question 306:

  Certification and Accreditation (CandA or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing systems prior to or after a system is in operation. Which of the following statements are true about Certification and Accreditation? Each correct answer represents a complete solution. Choose two.

  A. Certification is a comprehensive assessment of the management, operational, and technical security controls in an information system.
  B. Accreditation is a comprehensive assessment of the management, operational, and technical security controls in an information system.
  C. Accreditation is the official management decision given by a senior agency official to authorize operation of an information system.
  D. Certification is the official management decision given by a senior agency official to authorize operation of an information system.
  A. Certification is a comprehensive assessment of the management, operational, and technical security controls in an information system.
  C. Accreditation is the official management decision given by a senior agency official to authorize operation of an information system.

  ---

  Certification and Accreditation (CandA or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing systems prior to or after a system is in operation. The CandA process is used extensively in the U.S. Federal Government. Some CandA processes include FISMA, NIACAP, DIACAP, and DCID 6/3. Certification is a comprehensive assessment of the management, operational, and technical security controls in an information system, made in support of security accreditation, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system. Accreditation is the official management decision given by a senior agency official to authorize operation of an information system and to explicitly accept the risk to agency operations (including mission, functions, image, or reputation), agency assets, or individuals, based on the implementation of an agreed-upon set of security controls.

• Question 307:

  Digital rights management (DRM) consists of compliance and robustness rules. Which of the following features does the robustness rule have? Each correct answer represents a complete solution. Choose three.

  A. It specifies the various levels of robustness that are needed for asset security.
  B. It specifies minimum techniques for asset security.
  C. It specifies the behaviors of the DRM implementation and applications accessing the implementation.
  D. It contains assets, such as device key, content key, algorithm, and profiling data.
  A. It specifies the various levels of robustness that are needed for asset security.
  B. It specifies minimum techniques for asset security.
  D. It contains assets, such as device key, content key, algorithm, and profiling data.

  ---

  The DRM (digital rights management) technology includes the following rules:

  1.Compliance rule: This rule specifies the behaviors of the DRM implementation, and applications that are accessing the implementation. The compliance rule specifies the following elements:

  Definition of specific license rights Device requirements Revocation of license path or penalties when the implementation is not robust enough or noncompliant 2.Robustness rule: This rule has the following features: It specifies the various

  levels of robustness that are needed for asset security. It contains assets, such as device key, content key, algorithm, and profiling data. It specifies minimum techniques for asset security.

• Question 308:

  The National Information Assurance Certification and Accreditation Process (NIACAP) is the minimum standard process for the certification and accreditation of computer and telecommunications systems that handle U.S. national security information. Which of the following participants are required in a NIACAP security assessment? Each correct answer represents a part of the solution. Choose all that apply.

  A. Certification agent
  B. Designated Approving Authority
  C. IS program manager
  D. Information Assurance Manager
  E. User representative
  A. Certification agent
  B. Designated Approving Authority
  C. IS program manager
  E. User representative

  ---

  The NIACAP roles are nearly the same as the DITSCAP roles. Four minimum participants (roles) are required to perform a NIACAP security assessment: IS program manager: The IS program manager is the primary authorization advocate. He is responsible for the Information Systems (IS) throughout the life cycle of the system development. Designated Approving Authority (DAA): The Designated Approving Authority (DAA), in the United States Department of Defense, is the official with the authority to formally assume responsibility for operating a system at an acceptable level of risk. Certification agent: The certification agent is also referred to as the certifier. He provides the technical expertise to conduct the certification throughout the system life cycle. User representative: The user representative focuses on system availability, access, integrity, functionality, performance, and confidentiality in a Certification and Accreditation (CandA) process. Answer: D is incorrect. Information Assurance Manager (IAM) is one of the key participants in the DIACAP process.

• Question 309:

  Which of the following coding practices are helpful in simplifying code? Each correct answer represents a complete solution. Choose all that apply.

  A. Programmers should use multiple small and simple functions rather than a single complex function.
  B. Software should avoid ambiguities and hidden assumptions, recursions, and GoTo statements.
  C. Programmers should implement high-consequence functions in minimum required lines of code and follow proper coding standards.
  D. Processes should have multiple entry and exit points.
  A. Programmers should use multiple small and simple functions rather than a single complex function.
  B. Software should avoid ambiguities and hidden assumptions, recursions, and GoTo statements.
  C. Programmers should implement high-consequence functions in minimum required lines of code and follow proper coding standards.

  ---

  The various coding practices that are helpful in simplifying the code are as follows: Programmers should implement high-consequence functions in minimum required lines of code and follow the proper coding standards. Software should implement the functions that are defined in the software specification. Software should avoid ambiguities and hidden assumptions, recursion, and GoTo statements. Programmers should use multiple small and simple functions rather than a complex function. The processes should have only one entry point and minimum exit points. Interdependencies should be minimum so that a process module or component can be disabled when it is not needed, or replaced when it is found insecure or a better alternative is available, without disturbing the software operations. Programmers should use object-oriented techniques to keep the code simple and small. Some of the object-oriented techniques are object inheritance, encapsulation, and polymorphism. Answer: D is incorrect. Processes should have only one entry point and the minimum number of exit points.

• Question 310:

  Which of the following test methods has the objective to test the IT system from the viewpoint of a threat-source and to identify potential failures in the IT system protection schemes?

  A. Security Test and Evaluation (STandE)
  B. Penetration testing
  C. Automated vulnerability scanning tool
  D. On-site interviews
  B. Penetration testing

  ---

  The goal of penetration testing is to examine the IT system from the perspective of a threat-source, and to identify potential failures in the IT system protection schemes. Penetration testing, when performed in the risk assessment process, is used to assess an IT system's capability to survive with the intended attempts to thwart system security. Answer: A is incorrect. The objective of STandE is to ensure that the applied controls meet the approved security specification for the software and hardware and implement the organization's security policy or meet industry standards.