[Nov-2023] Check your preparation for ISC CSSLP On-Demand Exam [Q196-Q216]

QUESTION 196
Della work as a project manager for BlueWell Inc. A threat with a dollar value of $250,000 is expected to happen in her project and the frequency of threat occurrence per year is 0.01. What will be the annualized loss expectancy in her project?

$2,000

$2,500

$3,510

$3,500

QUESTION 197
Which of the following is a variant with regard to Configuration Management?

A CI that has the same name as another CI but shares no relationship.

A CI that particularly refers to a software version.

A CI that has the same essential functionality as another CI but a bit different in some small manner.

A CI that particularly refers to a hardware specification.

QUESTION 198
Which of the following is a malicious exploit of a website, whereby unauthorized commands are transmitted from a user trusted by the website?

Cross-Site Scripting

Injection flaw

Side channel attack

Cross-Site Request Forgery

Explanation:
CSRF (Cross-Site Request Forgery) is a malicious exploit of a website, whereby unauthorized commands are transmitted from a user trusted by the website. It is also known as a one-click attack or session riding. CSRF occurs when a user is tricked by an attacker into activating a request in order to perform some unauthorized action. It increases data loss and malicious code execution.

QUESTION 199
Which of the following activities are performed by the ‘Do’ cycle component of PDCA (plan-do-check-act)?
Each correct answer represents a complete solution. Choose all that apply.

It detects and responds to incidents properly.

It determines controls and their objectives.

It manages resources that are required to achieve a goal.

It performs security awareness training.

It operates the selected controls.

QUESTION 200
Which of the following security architectures defines how to integrate widely disparate applications for a world that is Web-based and uses multiple implementation platforms?

Sherwood Applied Business Security Architecture

Enterprise architecture

Service-oriented architecture

Service-oriented modeling and architecture

Explanation/Reference:
Explanation: In computing, a service-oriented architecture (SOA) is a flexible set of design principles used during the phases of systems development and integration. A deployed SOA-based architecture will provide a loosely-integrated suite of services that can be used within multiple business domains. SOA also generally provides a way for consumers of services, such as web-based applications, to be aware of available SOA-based services. For example, several disparate departments within a company may develop and deploy SOA services in different implementation languages; their respective clients will benefit from a well understood, well defined interface to access them. XML is commonly used for interfacing with SOA services, though this is not required. SOA defines how to integrate widely disparate applications for a world that is Web-based and uses multiple implementation platforms. Rather than defining an API, SOA defines the interface in terms of protocols and functionality. An endpoint is the entry point for such an SOA implementation.

(Layer interaction in Service-oriented architecture) AnswerA is incorrect. SABSA (Sherwood Applied Business Security Architecture) is a framework and methodology for Enterprise Security Architecture and Service Management. SABSA is a model and a methodology for developing risk-driven enterprise information security architectures and for delivering security infrastructure solutions that support critical business initiatives. The primary characteristic of the SABSA model is that everything must be derived from an analysis of the business requirements for security, especially those in which security has an enabling function through which new business opportunities can be developed and exploited. AnswerD is incorrect. The service-oriented modeling and architecture (SOMA) includes an analysis and design method that extends traditional object-oriented and component-based analysis and design methods to include concerns relevant to and supporting SOA. AnswerB is incorrect. Enterprise architecture describes the terminology, the composition of subsystems, and their relationships with the external environment, and the guiding principles for the design and evolution of an enterprise.

QUESTION 201
DoD 8500.2 establishes IA controls for information systems according to the Mission Assurance Categories (MAC) and confidentiality levels. Which of the following MAC levels requires high integrity and medium availability?

MAC III

MAC IV

MAC I

MAC II

QUESTION 202
John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. In order to do so, he performs the following steps of the pre-attack phase successfully: Information gathering Determination of network range Identification of active systems Location of open ports and applications Now, which of the following tasks should he perform next?

Perform OS fingerprinting on the We-are-secure network.

Map the network of We-are-secure Inc.

Install a backdoor to log in remotely on the We-are-secure server.

Fingerprint the services running on the we-are-secure network.

QUESTION 203
Which of the following DoD directives defines DITSCAP as the standard C&A process for the Department of Defense?

DoD 8910.1

DoD 5200.22-M

DoD 8000.1

DoD 5200.40

QUESTION 204
You work as a security manager for BlueWell Inc. You are going through the NIST SP 800-37 C&A methodology, which is based on four well defined phases. In which of the following phases of NIST SP 800-37 C&A methodology does the security categorization occur?

Security Accreditation

Security Certification

Continuous Monitoring

Initiation

QUESTION 205
Which of the following disaster recovery tests includes the operations that shut down at the primary site, and are shifted to the recovery site according to the disaster recovery plan?

Structured walk-through test

Full-interruption test

Parallel test

Simulation test

QUESTION 206
Which of the following ISO standards is entitled as “Information technology – Security techniques – Information security management – Measurement”?

ISO 27003

ISO 27005

ISO 27004

ISO 27006

QUESTION 207
You are responsible for network and information security at a large hospital. It is a significant concern that any change to any patient record can be easily traced back to the person who made that change. What is this called?

Availability

Confidentiality

Non repudiation

Data Protection

QUESTION 208
Which of the following terms refers to the protection of data against unauthorized access?

Integrity

Recovery

Auditing

Confidentiality

QUESTION 209
Which of the following statements best describes the difference between the role of a data owner and the role of a data custodian?

The custodian makes the initial information classification assignments, and the operations manager implements the scheme.

The data owner implements the information classification scheme after the initial assignment by the custodian.

The custodian implements the information classification scheme after the initial assignment by the operations manager.

The data custodian implements the information classification scheme after the initial assignment by the data owner.

QUESTION 210
Which of the following phases of DITSCAP includes the activities that are necessary for the continuing operation of an accredited IT system in its computing environment and for addressing the changing threats that a system faces throughout its life cycle?

Phase 3, Validation

Phase 1, Definition

Phase 2, Verification

Phase 4, Post Accreditation Phase

QUESTION 211
CORRECT TEXT
Fill in the blank with an appropriate phrase. models address specifications, requirements, design, verification and validation, and maintenance activities.

Life cycle

QUESTION 212
In which of the following deployment models of cloud is the cloud infrastructure administered by the organizations or a third party? Each correct answer represents a complete solution. Choose two.

Private cloud

Public cloud

Hybrid cloud

Community cloud

QUESTION 213
The IAM/CA makes certification accreditation recommendations to the DAA. The DAA issues accreditation determinations. Which of the following are the accreditation determinations issued by the DAA? Each correct answer represents a complete solution. Choose all that apply.

IATT

IATO

DATO

ATO

ATT

QUESTION 214
You work as the Senior Project manager in Dotcoiss Inc. Your company has started a software project using configuration management and has completed 70% of it. You need to ensure that the network infrastructure devices and networking standards used in this project are installed in accordance with the requirements of its detailed project design documentation. Which of the following procedures will you employ to accomplish the task?

Configuration identification

Configuration control

Functional configuration audit

Physical configuration audit

QUESTION 215
NIST SP 800-53A defines three types of interview depending on the level of assessment conducted. Which of the following NIST SP 800-53A interviews consists of informal and ad hoc interviews?

Comprehensive

Significant

Abbreviated

Substantial

QUESTION 216
In which of the following alternative processing sites is the backup facility maintained in a constant order, with a full complement of servers, workstations, and communication links ready to assume the primary operations responsibility?

Cold Site

Hot Site

Warm Site

Mobile Site

Leave a Reply Cancel reply