ISC CSSLP Online Practice Questions and Exam Preparation

ISC CSSLP Online Questions & Answers

• Question 71:

  Which of the following DoD directives is referred to as the Defense Automation Resources Management Manual?

  A. DoD 8910.1
  B. DoD 7950.1-M
  C. DoDD 8000.1
  D. DoD 5200.22-M
  E. DoD 5200.1-R
  B. DoD 7950.1-M

  ---

  The various DoD directives are as follows:

  DoD 5200.1-R: This DoD directive refers to the 'Information Security Program Regulation'. DoD 5200.22-M: This DoD directive refers the 'National Industrial Security Program Operating Manual'. DoD 7950.1-M: This DoD directive refers to the

  'Defense Automation Resources Management Manual'. DoDD 8000.1: This DoD directive refers to the 'Defense Information Management (IM) Program'. DoD 8910.1: This DoD directive refers to the 'Management and Control of Information

  Requirements'.

• Question 72:

  Which of the following are the benefits of information classification for an organization? Each correct answer represents a complete solution. Choose two.

  A. It helps reduce the Total Cost of Ownership (TCO).
  B. It helps identify which protections apply to which information.
  C. It helps identify which information is the most sensitive or vital to an organization.
  D. It ensures that modifications are not made to data by unauthorized personnel or processes.
  B. It helps identify which protections apply to which information.
  C. It helps identify which information is the most sensitive or vital to an organization.

  ---

  Following are the benefits of information classification for an organization: It helps identify which protections apply to which information. It helps identify which information is the most sensitive or vital to an organization. It supports the tenets of

  confidentiality, integrity, and availability as it pertains to data.

  Answer: D is incorrect. The concept of integrity ensures that modifications are not made to data by unauthorized personnel or processes. It also ensures that unauthorized modifications are not made to data by authorized personnel or

  processes. Answer: A is incorrect. Information classification cannot reduce the Total Cost of Ownership (TCO).

• Question 73:

  In which of the following processes are experienced personnel and software tools used to investigate, resolve, and handle process deviation, malformed data, infrastructure, or connectivity issues?

  A. Risk Management
  B. Exception management
  C. Configuration Management
  D. Change Management
  B. Exception management

  ---

  Exception management is a process in which experienced personnel and software tools are used to investigate, resolve, and handle process deviation, malformed data, infrastructure or connectivity issues. It increases the efficiency of business processes and contributes in the progress of business. Answer: C is incorrect. Configuration Management (CM) is an Information Technology Infrastructure Library (ITIL) IT Service Management (ITSM) process. It tracks all of the individual Configuration Items (CI) in an IT system, which may be as simple as a single server, or as complex as the entire IT department. In large organizations a configuration manager may be appointed to oversee and manage the CM process. Answer: A is incorrect. Risk Management is used to identify, assess, and control risks. It includes analyzing the value of assets to the business, identifying threats to those assets, and evaluating how vulnerable each asset is to those threats. Risk Management is part of Service Design and the owner of the Risk Management is the Risk Manager. Risks are addressed within several processes in ITIL V3; however, there is no dedicated Risk Management process. ITIL V3 calls for "coordinated risk assessment exercises", so at IT Process Maps we decided to assign clear responsibilities for managing risks. Answer: D is incorrect. Change Management is used to ensure that standardized methods and procedures are used for efficient handling of all changes. A change is "an event that results in a new status of one or more configuration items (CI's)" approved by management, cost effective, enhances business process changes (fixes) - with a minimum risk to IT infrastructure. The main aims of Change Management are as follows: Minimal disruption of services Reduction in back-out Economic utilization of resources involved in the change

• Question 74:

  Stella works as a system engineer for BlueWell Inc. She wants to identify the performance thresholds of each build. Which of the following tests will help Stella to achieve her task?

  A. Reliability test
  B. Performance test
  C. Regression test
  D. Functional test
  B. Performance test

  ---

  The various types of internal tests performed on builds are as follows: Regression tests: It is also known as the verification testing. These tests are developed to confirm that capabilities in earlier builds continue to work correctly in the

  subsequent builds. Functional test:

  These tests emphasizes on verifying that the build meets its functional and data requirements and correctly generates each expected display and report. Performance tests: These tests are used to identify the performance thresholds of each

  build. Reliability tests: These tests are used to identify the reliability thresholds of each build.

• Question 75:

  Fill in the blank with an appropriate phrase. models address specifications, requirements, design, verification and validation, and maintenance activities.

  Life cycle

  A life cycle model helps to provide an insight into the development process and emphasizes on the relationships among the different activities in this process. This model describes a structured approach to the development and adjustment process involved in producing and maintaining systems. The life cycle model addresses specifications, design, requirements, verification and validation, and maintenance activities.

• Question 76:

  Security is a state of well-being of information and infrastructures in which the possibilities of successful yet undetected theft, tampering, and/or disruption of information and services are kept low or tolerable. Which of the following are the elements of security? Each correct answer represents a complete solution. Choose all that apply.

  A. Integrity
  B. Authenticity
  C. Confidentiality
  D. Availability
  A. Integrity
  B. Authenticity
  C. Confidentiality
  D. Availability

  ---

  The elements of security are as follows: 1.Confidentiality: It is the concealment of information or resources. 2.Authenticity: It is the identification and assurance of the origin of information. 3.Integrity: It refers to the trustworthiness of data or resources in terms of preventing improper and unauthorized changes. 4.Availability: It refers to the ability to use the information or resources as desired.

• Question 77:

  Which of the following tiers addresses risks from an information system perspective?

  A. Tier 0
  B. Tier 3
  C. Tier 2
  D. Tier 1
  B. Tier 3

  ---

  The information system level is the tier 3. It addresses risks from an information system perspective, and is guided by the risk decisions at tiers 1 and 2. Risk decisions at tiers 1 and 2 impact the ultimate selection and deployment of requisite safeguards. This also has an impact on the countermeasures at the information system level. The RMF primarily operates at tier3 but it can also have interactions at tiers 1 and 2. Answer: A is incorrect. It is an invalid Tier description. Answer: D is incorrect. The Organization Level is the Tier 1, and it addresses risks from an organizational perspective. Answer: C is incorrect. The mission and business process level is the Tier 2, and it addresses risks from the mission and business process perspective.

• Question 78:

  The mission and business process level is the Tier 2. What are the various Tier 2 activities? Each correct answer represents a complete solution. Choose all that apply.

  A. Developing an organization-wide information protection strategy and incorporating high-level information security requirements
  B. Defining the types of information that the organization needs, to successfully execute the stated missions and business processes
  C. Specifying the degree of autonomy for the subordinate organizations
  D. Defining the core missions and business processes for the organization
  E. Prioritizing missions and business processes with respect to the goals and objectives of the organization
  A. Developing an organization-wide information protection strategy and incorporating high-level information security requirements
  B. Defining the types of information that the organization needs, to successfully execute the stated missions and business processes
  C. Specifying the degree of autonomy for the subordinate organizations
  D. Defining the core missions and business processes for the organization
  E. Prioritizing missions and business processes with respect to the goals and objectives of the organization

  ---

  The mission and business process level is the Tier 2. It addresses risks from the mission and business process perspective. It is guided by the risk decisions at Tier 1. The various Tier 2 activities are as follows: It defines the core missions and business processes for the organization. It also prioritizes missions and business processes, with respect to the goals and objectives of the organization. It defines the types of information that an organization requires, to successfully execute the stated missions and business processes. It helps in developing an organization-wide information protection strategy and incorporating high-level information security requirements. It specifies the degree of autonomy for the subordinate organizations.

• Question 79:

  The Chief Information Officer (CIO), or Information Technology (IT) director, is a job title commonly given to the most senior executive in an enterprise. What are the responsibilities of a Chief Information Officer? Each correct answer represents a complete solution. Choose all that apply.

  A. Facilitating the sharing of security risk-related information among authorizing officials
  B. Preserving high-level communications and working group relationships in an organization
  C. Establishing effective continuous monitoring program for the organization
  D. Proposing the information technology needed by an enterprise to achieve its goals and then working within a budget to implement the plan
  B. Preserving high-level communications and working group relationships in an organization
  C. Establishing effective continuous monitoring program for the organization
  D. Proposing the information technology needed by an enterprise to achieve its goals and then working within a budget to implement the plan

  ---

  A Chief Information Officer (CIO) plays the role of a leader. The responsibilities of a Chief Information Officer are as follows: Establishes effective continuous monitoring program for the organization. Facilitates continuous monitoring process for the organizations. Preserves high- level communications and working group relationships in an organization. Confirms that information systems are covered by a permitted security plan and monitored throughout the System Development Life Cycle (SDLC). Manages and delegates decisions to employees in large enterprises. Proposes the information technology needed by an enterprise to achieve its goals and then works within a budget to implement the plan. Answer: A is incorrect. A Risk Executive facilitates the sharing of security risk-related information among authorizing officials.

• Question 80:

  Which of the following persons in an organization is responsible for rejecting or accepting the residual risk for a system?

  A. Information Systems Security Officer (ISSO)
  B. Designated Approving Authority (DAA)
  C. System Owner
  D. Chief Information Security Officer (CISO)
  B. Designated Approving Authority (DAA)

  ---

  The authorizing official is the senior manager responsible for approving the working of the information system. He is responsible for the risks of operating the information system within a known environment through the security accreditation phase. In many organizations, the authorizing official is also referred as approving/accrediting authority (DAA) or the Principal Approving Authority (PAA). Answer: C is incorrect. The system owner has the responsibility of informing the key officials within the organization of the requirements for a security CandA of the information system. He makes the resources available, and provides the relevant documents to support the process. Answer: A is incorrect. An Information System Security Officer (ISSO) plays the role of a supporter. The responsibilities of an Information System Security Officer (ISSO) are as follows: Manages the security of the information system that is slated for Certification and Accreditation (CandA). Insures the information systems configuration with the agency's information security policy. Supports the information system owner/information owner for the completion of security-related responsibilities. Takes part in the formal configuration management process. Prepares Certification and Accreditation (CandA) packages. Answer: D is incorrect. The CISO has the responsibility of carrying out the CIO's FISMA responsibilities. He manages the information security program functions.