CISSP Exam Quiz 01

Question 1 of 30

1. Question

International Information Systems Security Certification Consortium or (ISC)2 represents what?

Global not-for-profit organization.
CISSP exam.
Certification.
All of the above.

Question 2 of 30

2. Question

From the long numbers of missions (ISC)2 has which one represents the primary mission in this organization?

Maintain the Common Body of Knowledge (CBK) for the field of information systems security.
Asset Security
Security and Risk Management
Security Operations

Question 3 of 30

3. Question

How many times are you allowed to retake the CISSP exam in the 12-month period after failing to do it the first time?

2 times per 12-month period.
4 times per 12-month period.
3 times per 12-month period.
None. You have to wait for 12 more months to retake the test.

Question 4 of 30

4. Question

What is the name of the final step after completing the certification process?

USPS.
Endorsement.
CISSP.
Final step certification.

Question 5 of 30

5. Question

What is the aim focus of ISSMP or Information Systems Security Management Professional?

Those who focus on the management of information security policies, practices, principles, and procedures.
Those who specialize in information security architecture.
Those who focus on the design and engineering of secure hardware and software information systems, components, or applications.
None of the above.

Question 6 of 30

6. Question

Which one of these is included in the additional study tools?

Additional descriptions
Written labs
Electronic Flashcards
Practice questions

Question 7 of 30

7. Question

What is the biggest problem of using onetime password generators?

The passwords that are being created are too weak
If the battery dies or the device breaks, the user won’t be able to gain access
The passwords are too complex
People find it difficult to remember passwords that change so frequently

Question 8 of 30

8. Question

Which one of these biometrics are unique to an individual and have been used for decades in physical security for identification?

Retina Scans
Fingerprints
Face Scans
Iris Scans

Question 9 of 30

9. Question

What is the definition of Concealment?

Quality of information, which could cause harm or damage if disclosed
An act of decision where an operator can influence or control disclosure in order to minimize harm or damage
The act of hiding or preventing disclosure
The act of keeping something a secret or preventing the disclosure of information

Question 10 of 30

10. Question

What does the CIA Triad contain?

Availability
Integrity
Confidentiality
All of the above

Question 11 of 30

11. Question

What do numerous attacks on violation of integrity include?

Logic bombs
Human error
Entering invalid data
Altering configurations

Question 12 of 30

12. Question

What is ensured by the nonrepudiation?

Ensures a high level of assurance that the data, objects, and resources are accessible to authorized subjects
Ensures that the subject of the activity or who caused an event cannot deny that the event occurred
Ensures timely and uninterrupted access to objects
Ensures protection controls

Question 13 of 30

13. Question

To how many elements does AAA service refer to?

Two elements
Three elements
Four elements
Five elements

Question 14 of 30

14. Question

What is the meaning of auditing?

The process of verifying or testing that the claimed identity is valid
The process ensures that the requested activity or access to an object is possible given the rights and privileges assigned to the authenticated identity
The programmatic means by which a subject’s actions are tracked and recorded to hold the subject accountable for their actions while authenticated on a system.
The process by which a subject professes an identity and accountability is initiated.

Question 15 of 30

15. Question

What is the definition of layering?

It is used for efficiency
Another aspect of understanding and applying concepts of confidentiality, integrity, and availability
It is the art and science of hiding the meaning or intent of communication from unintended recipients.
It is simply the use of multiple controls in a series

Question 16 of 30

16. Question

What is the definition of security governance?

It is a tool that prevents data from being discovered or accessed by a subject by positioning the data in a logical storage compartment that is not accessible or seen by the subject
It is the collection of practices related to supporting, defining, and directing the security efforts of an organization.
The point of security that keeps bad things from happening while supporting the occurrence of good things.
It is a type of watching or oversight

Question 17 of 30

17. Question

Which one represents one of the change management several goals?

Assisting in identifying those assets that are most critical or valuable to the organization
Maturity or age of the data
Timeliness of the data
Implement changes in a monitored and orderly manner

Question 18 of 30

18. Question

How many steps you must perform to implement a classification scheme?

Nine major steps
Six major steps
Three major steps
Seven major steps

Question 19 of 30

19. Question

depending on the data type what is the unclassified term used for?

Is the highest level of classification
Is used for data of a sensitive, proprietary, or highly valuable nature
Is used for data that is neither sensitive nor classified
Is used for data that is for internal use or for office use only

Question 20 of 30

20. Question

What is the highest level of classification in commercial business/private sector levels?

Private
Confidential
Sensitive
Public

Question 21 of 30

21. Question

Which logical order of following roles that appear in a secured environment is correct?

Senior Manager, Security Professional, Auditor, Data Custodian, User, Data Owner
Auditor, User, Senior Manager, Security Professional, Data Owner, Data Custodian
Senior Manager, Security Professional, Data Owner, Data Custodian, User, Auditor
Senior Manager, Data Owner, Security Professional, Data Custodian, Auditor, User

Question 22 of 30

22. Question

What type of access control does single sign-on provide to a subject once it gets on the system?

It gives them many directory services that are based on the Lightweight Directory Access Protocol
It includes methods to protect user credentials
It provides access to multiple resources without authenticating again
Access to multiple domains and trusts

Question 23 of 30

23. Question

What is the first principle of COBIT 5?

Separating Governance From Management
Applying a Single, Integrated Framework
Meeting Stakeholder Needs
Covering the Enterprise End-to-End

Question 24 of 30

24. Question

What is the definition of security policies?

Recommendations on how standards and baselines are implemented and serve as an operational guide for both security professionals and users
It is a document that defines the scope of security needed by the organization and discusses the assets that require protection and the extent to which security solutions should go to provide the necessary protection.
Compulsory requirements for the homogenous use of hardware, software, technology, and security controls
A minimum level of security that every system throughout the organization must meet

Question 25 of 30

25. Question

What is PASTA or Process for Attack Simulation and Threat Analysis?

Italian meal
An attack that attempts to prevent authorized use of a resource
A risk-centric approach that aims at selecting or developing countermeasures to the value of the assets to be protected
An attack where a limited user account is transformed into an account with greater privileges, powers, and access. This might be accomplished through theft or exploitation of the credentials of a higher-level account, such as that of an administrator or root

Question 26 of 30

26. Question

How many stages does PASTA contain?

Seven stages
Three stages
Six stages
Two stages

Question 27 of 30

27. Question

In which stages do these elements appear Threat Analysis, Risk Analysis & Management and Definition of the Technical Scope?

Stages I, IV, VII.
Stages V, VI, II.
Stages III, VII, I.
Stages IV, VII, II.

Question 28 of 30

28. Question

How many key concepts you must identify in the decomposition process?

Ten key concepts
Nine key concepts
Eight key concepts
Five key concepts

Question 29 of 30

29. Question

What is DREAD designed for?

It is designed for exploitability
It is designed for reproducibility
It is designed to provide a flexible rating solution that is based on the answers to five main questions about each threat
It is designed for Discoverability

Question 30 of 30

30. Question

What do we complete with the Document Exchange and Review process?

Having an independent third-party auditor, as defined by the American Institute of Certified Public Accountants (AICPA)
Investigate how datasets and documentation are exchanged as well as the formal processes by which they perform assessments and reviews.
Request copies of their security policies, processes/procedures, and documentation of incidents and responses for review.
Visit the site of the organization to interview personnel and observe their operating habits