Pass Guaranteed Quiz 2021 Realistic Verified Free CISSP Exam Dumps
Free ISC Certification CISSP Ultimate Study Guide (Updated 990 Questions)
NEW QUESTION 366
Which of the following is NOT a symmetric key algorithm?
- A. Blowfish
- B. Digital Signature Standard (DSS)
- C. RC5
- D. Triple DES (3DES)
Answer: B
Explanation:
Digital Signature Standard (DSS) specifies a Digital Signature Algorithm (DSA)
appropriate for applications requiring a digital signature, providing the capability to generate
signatures (with the use of a private key) and verify them (with the use of the corresponding public
key).
Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002,
chapter 8: Cryptography (page 550).
Reference: DSS: http://www.itl.nist.gov/fipspubs/fip186.htm.
NEW QUESTION 367
Which choice below is NOT considered a potential hazard resulting
from natural events?
- A. Forest fire
- B. Arson
- C. Urban fire
- D. Earthquake/land shift
Answer: B
Explanation:
According to the NFPA, arson is an example of a potential hazard caused by a human event. Fires, in themselves, are considered natural events, like forest fires, range fires, urban or city fires, unless arson is thought to be the source of the blazE. Of the three categories of potential hazards (natural, technological, and human), human events could include: General strikes Terrorism Sabotage Mass hysteria Civil unrest Source: NFPA 1600 Standard on Disaster/Emergency Management and Business Continuity, National Fire Protection Association, 2000 edition.
NEW QUESTION 368
What is considered the major disadvantage to employing a hot site for
disaster recovery?
- A. Annual testing is required to maintain the site.
- B. The site is immediately available for recovery.
- C. Exclusivity is assured for processing at the site.
- D. Maintaining the site is expensive.
Answer: D
Explanation:
The correct answer is the expense of maintaining the site. A hot
site is commonly used for those extremely time-critical functions that
the business must have up and running to continue operating, but
the expense of duplicating and maintaining all of the hardware, software, and application elements is a serious resource drain to most organizations.
NEW QUESTION 369
Which of the following are PRIMARY elements that are required when designing a Disaster Recovery Plan (DRP)?
- A. Impact assessment, recover strategy, and testing.
- B. Insurance coverage, alternate site, and manual procedures.
- C. Back-up procedures, off-site storage, and data recover.
- D. Steering committee, emergency response team, and reconstruction team.
Answer: A
Explanation:
The most critical piece to disaster recovery and continuity planning is management support. They must be convinced of its necessity. Therefore, a business case must be made to obtain this support. The business case can include current vulnerabilities, regulatory and legal obligations, current status of recovery plans, and recommendations. Management will mostly concerned with cost/benefit issues, so several preliminary numbers will need to be gathered and potential losses estimated. - Shon Harris All-in-one CISSP Certification Guide pg 595 There are four major elements of the BCP process Scope and Plan Initiation - this phase marks the beginning of the BCP process. IT entails creating the scope and other elements needed to define the parameters of the plan. Business Impact Assessment - A BIA is a process used to help business units understand the impact of a disruptive event. This phase includes the execution of a vulnerability assessment Business Continuity Plan Development - This term refers to using the information collection in the BIA to develop the actual business continuity plan. This process includes the areas of plan implementation, plan testing, and ongoing plan maintenance. Plan Approval and Implementation - This process involves getting the final senior management signoff, creating enterprise-wide awareness of the plan, and implementing a maintenance procedure for updating the plan as needed. -Ronald Krutz The CISSP PREP Guide (gold edition) pg 380-381
NEW QUESTION 370
Which of the following should be used as a replacement for Telnet for secure remote login over an insecure network?
- A. SSL
- B. S-Telnet
- C. Rlogin
- D. SSH
Answer: D
Explanation:
SSH is a protocol for secure remote login and other secure network services over an insecure network. It consists of three major components: a transport layer protocol
(providing server authentication, confidentiality, and integrity), a user authentication protocol (authenticating the client-side user to the server) and a connection protocol
(multiplexing the encrypted tunnel into several logical channels). It should be used instead of Telnet, FTP, rlogin, rexec and rsh.
Source: SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000.
And: WALLHOFF, John, CBK#5 Cryptography (CISSP Study Guide), April 2002 (page 8).
NEW QUESTION 371
In an object-oriented system, polymorphism denotes:
- A. Objects of many different classes that are related by some common
superclass; thus, any object denoted by this name can respond to
some common set of operations in a different way. - B. Objects of the same class; thus, any object denoted by this name can respond to some common set of operations in the same way.
- C. Objects of many different classes that are related by some common
superclass; thus, all objects denoted by this name can respond to some
common set of operations in identical fashion. - D. Objects of many different classes that are unrelated but respond to
some common set of operations in the same way.
Answer: A
Explanation:
Objects of many different classes that are
related by some common superclass that are able to respond to some
common set of operations in a different way.
The other answers are incorrect by the definition of polymorphism.
NEW QUESTION 372
Which of the following best describes the difference between a circuit based and application based firewall?
- A. Application based builds a state table
- B. Circuit based firewalls are only found in Cisco routers
- C. Application based is more flexible and handles more protocols
- D. Circuit based provides more security
- E. Circuit based looks at IP addresses and ports
Answer: E
Explanation:
Circuit based look only at IP address and ports, whereas application based dig much deeper into the packet. This makes it more secure.
NEW QUESTION 373
Which of the following ciphers is a subset on which the Vigenere polyalphabetic cipher was based on?
- A. The Jefferson disks
- B. SIGABA
- C. Enigma
- D. Caesar
Answer: D
Explanation:
In cryptography, a Caesar cipher, also known as Caesar's cipher, the shift cipher, Caesar's code or Caesar shift, is one of the simplest and most widely known encryption techniques. It is a type of substitution cipher in which each letter in the plaintext is replaced by a letter some fixed number of positions down the alphabet. For example, with a left shift of 3, D would be replaced by A, E would become B, and so on. The method is named after Julius Caesar, who used it in his private correspondence.
The encryption step performed by a Caesar cipher is often incorporated as part of more complex schemes, such as the Vigenere cipher, and still has modern application in the ROT13 system. As with all single alphabet substitution ciphers, the Caesar cipher is easily broken and in modern practice offers essentially no communication security.
The following answer were incorrect: The Jefferson disk, or wheel cipher as Thomas Jefferson named it, also known as the Bazeries Cylinder, is a cipher system using a set of wheels or disks, each with the 26 letters of the alphabet arranged around their edge. The order of the letters is different for each disk and is usually scrambled in some random way. Each disk is marked with a unique number. A hole in the centre of the disks allows them to be stacked on an axle. The disks are removable and can be mounted on the axle in any order desired. The order of the disks is the cipher key, and both sender and receiver must arrange the disks in the same predefined order. Jefferson's device had 36 disks.
An Enigma machine is any of a family of related electro-mechanical rotor cipher machines used for the encryption and decryption of secret messages. Enigma was invented by the German engineer Arthur Scherbius at the end of World War I. The early models were used commercially from the early 1920s, and adopted by military and government services of several countries. Several different Enigma models were produced, but the German military models are the ones most commonly discussed.
SIGABA: In the history of cryptography, the ECM Mark II was a cipher machine used by the United States for message encryption from World War II until the 1950s. The machine was also known as the SIGABA or Converter M-134 by the Army, or CSP-888/889 by the Navy, and a modified Navy version was termed the CSP-2900. Like many machines of the era it used an electromechanical system of rotors in order to encipher messages, but with a number of security improvements over previous designs. No successful cryptanalysis of the machine during its service lifetime is publicly known.
Reference(s) used for this question: http://en.wikipedia.org/wiki/Jefferson_disk http://en.wikipedia.org/wiki/Sigaba http://en.wikipedia.org/wiki/Enigma_machine
NEW QUESTION 374
Which of the following best ensures accountability of users for the actions taken within a system or domain?
- A. Authorization
- B. Identification
- C. Authentication
- D. Credentials
Answer: C
Explanation:
The only way to ensure accountability is if the subject is uniquely identified and authenticated. Identification alone does not provide proof the user is who they claim to be. After showing proper credentials, a user is authorized access to resources.
References:
HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002,
Chapter 4: Access Control (page 126).
NEW QUESTION 375
What is used to bind a document to it's creation at a particular time?
- A. Digital Signature
- B. Certification Authority (CA)
- C. Digital Timestamp
- D. Network Time Protocol (NTP)
Answer: C
NEW QUESTION 376
Which of the following is used to detect steganography?
- A. Reverse engineering
- B. Cryptanalysis
- C. Audio analysis
- D. Statistical analysis
Answer: D
NEW QUESTION 377
What is the Network Layer of the OSI reference model primarily
responsible for?
- A. Signal regeneration and repeating
- B. LAN bridging
- C. Internetwork packet routing
- D. SMTP Gateway services
Answer: C
Explanation:
Although many routers can perform most of the functions above, the
OSI Network layer is primarily responsible for routing.
* LAN bridging, is a Data Link Layer function.
* gateways, most commonly function at the higher layers.
* signal regeneration and repeating, is primarily a Physical layer function. Source: CCNA
Study Guide by Todd Lammle, Donald Porter, and James Chellis (Sybex, 1999).
NEW QUESTION 378
Which of the following is the marriage of object-oriented and relational technologies combining the attributes of both?
- A. object-relational database
- B. object-oriented database
- C. object-management database
- D. object-linking database
Answer: A
Explanation:
The object-relational database is the marriage of object-oriented and relational technologies and combines the attributes of both. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 48.
NEW QUESTION 379
Database views are NOT used to:
- A. Implement referential integrity
- B. Implement need-to-know
- C. Implement least privilege
- D. To implement content-dependent access restrictions
Answer: A
Explanation:
A view is considered as a virtual table that is derived from other tables. It can be used to restrict access to certain information within the database, to hide attributes, and to implement content-dependent access restrictions. It does not implement referential integrity.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 2: Access control systems (page 46).
NEW QUESTION 380
What is the motivation for use of the Online Certificate Status Protocol (OCSP)?
- A. To issue X.509v3 certificates more quickly
- B. To return information on multiple certificates
- C. To provide timely up-to-date responses to certificate queries
- D. To control access to Certificate Revocation List (CRL) requests
Answer: A
NEW QUESTION 381
Operations Security seeks to primarily protect against which of the following?
- A. facility disaster
- B. object reuse
- C. compromising emanations
- D. asset threats
Answer: D
Explanation:
The correct answer is asset threats. A threat is any circumstance or event with the potential to cause harm.
The most important reason for identifying threats is to know from what do the assets need protection and what is the likelihood that a threat will occur. Threats cannot be eliminated, but can be anticipated, and safeguards put in place to minimize their impact.
Operations Security provides audit and monitoring for mechanisms, tools and facilities which permit the identification of security events and documentation of subsequent corrective actions.
Source: State of Nebraska - Information Security Systems (ISS) Security Officer Instruction
Guide.
NEW QUESTION 382
Which of the following attacks focus on cracking passwords?
- A. Teardrop
- B. Dictionary
- C. SMURF
- D. Spamming
Answer: B
Explanation:
Dictionaries may be used in a cracking program to determine passwords. A short dictionary attack involves trying a list of hundreds or thousands of words that are frequently chosen as passwords against several systems. Although most systems resist such attacks, some do not. In one case, one system in five yielded to a particular dictionary attack.
NEW QUESTION 383
......
Get to the Top with CISSP Practice Exam Questions: https://pass4sure.trainingquiz.com/CISSP-training-materials.html
