Q1172
A password that is the same for each log-on session is called a?
551
ISC CISSP Exam
A. “one-time password”
B. “two-time password”
C. static password
D. dynamic password
Answer: C
Explanation: A Static password is one that remains the same until its changed. Its like the password that we
use in the operating systems, you set it, and then you always use the same password to logon to the system for
the time of the session. This password will give us access to the system and will be the vehicle to create our
access token in a successful way to get our privileges. A one-time password is only valid for one use, dynamic
ones change every certain condition is met, and two-time passwords can only be used two times. We can
provide certain times of access with this kind of passwords.
Q1173
Which of the following backup methods is most appropriate for off-site archiving?
A. Incremental backup method.
B. Off-site backup method.
C. Full backup method.
D. Differential backup method.
Answer: C
Explanation: Since we want to maintain the backups offsite, its always better to send FULL- Backups because
they contain a consistent base of the system. We perform the beginning of a restore through a full backup.
Remember that the backups stored offsite are in most cases in a secure place, full backup in there are a best
practice for any network administrator. With incremental or differential backups we don’t have all we need to
restore a system to a consistent state. We need to start from the full backup. “Offsite Backup” is not a valid
backup method.
552
ISC CISSP Exam
Q1174
Which of the following is not a weakness of symmetric cryptography?
A. Limited security
B. Key distribution
C. Speed
D. Scalability
Answer: C
Explanation: In secret key cryptography, a single key is used for both encryption and decryption. The sender
uses the key (or some set of rules) to encrypt the plaintext and sends the cipher text to the receiver. The
receiver applies the same key (or rule set) to decrypt the message and recover the plaintext. Because a single
key is used for both functions, secret key cryptography is also called symmetric encryption.
With this form of cryptography, it is obvious that the key must be known to both the sender and the receiver;
that, in fact, is the secret. The biggest difficulty with this approach, of course, is the distribution of the key.
Symmetric encryption is around 1000 times faster than Asymmetric encryption, the second is commonly used
just to encrypt the keys for Symmetric Cryptography.
Q1175
Which of the following is not a defined layer in the TCP/IP protocol model?
A. Application layer
B. Session layer
C. Internet layer
D. Network access layer
Answer: B
Explanation: The TCP/IP reference model is the network model used in the current Internet architecture. It has
its origins back in the 1960’s with the grandfather of the Internet, the ARPANET. This was a research network
sponsored by the Department of Defense in the United States.
The reference model was named after two of its main protocols, TCP (Transmission Control
553
ISC CISSP Exam
Protocol) and IP (Internet Protocol). They choose to build a packet-switched network based on a
connectionless internet layer. Here is a representation of it:
“The TCP/IP Protocol Model is similar to the OSI model, but it defines only the following four layers instead of
seven:
Application Layer. Consists of the applications and processes that use the network.
Host-to-Host Transport Layer. Provides end-to-end data delivery service to the Application Layer.
Internet Layer. Defines the IP datagram and handles the routing of data across networks.
Network Access or Link Layer. Consists of routines for accessing physical networks and the electrical
connection.”
Pg 112 Krutz: The CISSP Prep Guide: Gold Edition.
Q1176
554
ISC CISSP Exam
Rewritable and erasable (CDR/W) optical disk are sometimes used for backups that require short time storage
for changeable data, but require?
A. Faster file access than tape.
B. Slower file access than tape.
C. Slower file access than drive.
D. Slower file access than scale.
Answer: A
Explanation: This is true, when we use optical media like CD´s to make our backups we need a constant
throughput on the file access and data transfer inside the disk because of the risk to get a buffer overrun error
in the CD writer. If the buffer user by the CD burner is empty and the Hard disk does not provide data for that
time, the Backup will be unsuccessful. This can be solved with a Technology known as “Burn Proof”.
Q1177
Which one of the following is not a primary component or aspect of firewall systems?
A. Protocol filtering
B. Packet switching
C. Rule enforcement engine
D. Extended logging capability
Answer: B
Explanation: This is not a main function of a firewall, packet switching is a main feature of a Switch (working
only in the layer 2 of the OSI model). Firewall are network security devices that can function through layer 2 to
layer 7 of the OSI model. They usually include rule engine that enforce the enterprise security policy of the
company. They provide protocol filtering to enforce our requirements through the forwarded or deny of traffic.
They also provide logging capabilities so we can analyze what is happening in a very low level in our network.
555
ISC CISSP Exam
Q1178
What are database views used for?
A. To ensure referential integrity.
B. To allow easier access to data in a database.
C. To restrict user access to data in a database.
D. To provide audit trails.
Answer: C
Explanation: Through the use of a view we can provide security for the organization restricting users access to
certain data or to the real tables containing the information in our database. For example, we can create a view
that brings data from 3 tables, only showing 2 of the 4 columns in each. Instead of giving access to the tables
that contain the information, we give access to the view, so the user can access this fixed information but does
not have privileges over the tables containing it. This provides security.
Q1179
Which of the following Common Data Network Services is used to send and receive email internally or
externally through an email gateway device?
A. File services
B. Mail services
C. Print services
D. Client/Server services
Answer: B
Explanation: This functionality is provided through mail services, this service permits collaboration between
users in an internal and external level. We usually use two protocols, “SMTP” in port TCP 25 to send the emails
and “POP3″ in port TCP 110 to receive them. Currently there is another protocol that is gaining popularity, it is
“IMAP4″. Print services are used for printing documents and file services are used to share and access files
and folders inside the
556
ISC CISSP Exam
infrastructure.
Q1180
Intrusion detection has which of the following sets of characteristics.
A. It is adaptive rather than preventive.
B. It is administrative rather than preventive.
C. It is disruptive rather than preventative.
D. It is detective rather than preventative.
Answer: D
Explanation: This is one of the features of intrusion detections, instead of being pro-active, it has a reactive
behavior. When we set an IDS system inside of our network or hosts, the IDS agent is constantly monitoring in
real time what activities are being performed in the infrastructure. If the IDS founds a malicious activity taking
place it can take actions against it like disabling interfaces, alerting the administrators or sending network
attacks to the source to put it out of service. As a difference to the detective behavior of IDS, we can also
increase the security with practices like hardening our systems ,this is considered a preventive practice.
Q1181
Which type of password provides maximum security because a new password is required for each now log-on
is defined to as?
A. One-time or dynamic password
B. Cognitive password
C. Static password
D. Pass phrase
557
ISC CISSP Exam
Answer: A
Explanation: “One-time” or “dynamic” password technology concept is having your remote host already know a
password that is not going to go over insecure channels and when you connect, you get a challenge. You take
the challenge information and password and plug it into an algorithm which generates the response that should
get the same answer if the password is the same on the both sides. Therefore the password never goes over
the network, nor is the same challenge used twice. Unlike SecurID or SNK, with S/key you do not share a
secret with the host. Other one time password technology is card systems where each user gets a card that
generates numbers that allow access to their account. Without the card, it is improbable to guess the numbers.
Q1182
They in form of credit card-size memory cards or smart cards, or those resembling small calculators, are used
to supply static and dynamic passwords are called?
A. Token Ring
B. Tokens
C. Token passing networks
D. Coupons
Answer: B
Explanation: Tokens are usually used to provide authentication through “What we have”, is most commonly
implemented to provide two-factor authentication. For example, SecurID requires two pieces of information, a
password and a token. The token is usually generated by the SecurID token a small electronic device that
users keep with them that display a new number every 60 seconds. Combining this number with the users
password allows the SecurID server to determine whatever or not the user should be granted access.
Q1183
558
ISC CISSP Exam
Which of the following uses a directed graph to specify the rights that a subject can transfer to an object, or that
a subject can take from another subject?
A. Take-Grant model
B. Access Matrix model
C. Biba model
D. Bell-Lapadula model
Answer: A
Explanation: The Take-Grant System is a model that helps in determining the protection rights (e.g., read or
write) in a computer system. The Take-Grant system was introduced by Jones, Lipton, and Snyder to show that
it is possible to decide on the safety of a computer system even when the number of subjects and objects are
very large, or unbound. This can be accomplished in linear time based on the initial size of the system. The
take-grant system models a protection system which consists of a set of states and state transitions. A directed
graph shows the connections between the nodes of this system. These nodes are representative of the
subjects or objects of the model. The directed edges between the nodes represent the rights that one node has
over the linked node.
Q1184
Which of the following is the BEST way to prevent software license violations?
A. Implementing a corporate policy on copyright infringements and software use.
B. Requiring that all PCs be diskless workstations.
C. Installing metering software on the LAN so applications can be accessed through the metered software.
D. Regularly scanning used PCs to ensure that unauthorized copies of software have not been loaded on the
PC.
Answer: D
Explanation: Since its impossible to control all the efforts of the users to install software without the proper
licenses in their PC´s (Specially downloaded from the Internet), the best way to prevent licenses violations is
through regular audit to every single user PC to see what’s the installed programs are and what’s the nature of
them (Shareware, freeware, licensed). We cant use LAN
559
ISC CISSP Exam
monitoring software because not all the applications are network enabled, also, there is usually a policy about
software installation, but the users do not rely on them many times. It also a very nice practice to punish the
users making software license violations.
Q1185
Zip/Jaz drives, SyQuest, and Bemoulli boxes are very transportable and are often the standard for?
A. Data exchange in many businesses.
B. Data change in many businesses.
C. Data compression in many businesses.
D. Data interchange in many businesses.
Answer: A
Explanation: This is the primary use of this kind of devices, since they are very portable (a medium-size
external box) and they provide standard interfaces to the PC, they are usually used in data exchange because
of their high capacity in comparison to the 3.5 floppy diskettes. We can make changes in the media used by
this devices, but is not their primary use. Compression is not the best feature of this devices, their usually
depend on File system compression. Absolutely, the best use of this boxes is for data exchange.
Q1186
What are two types of system assurance?
A. Operational Assurance and Architecture Assurance.
B. Design Assurance and Implementation Assurance.
C. Architecture Assurance and Implementation Assurance.
D. Operational Assurance and Life-Cycle Assurance.
560
ISC CISSP Exam
Answer: D
Explanation: Software Systems Quality Assurance (SQA) is defined as a planned and systematic approach to
the evaluation of the quality of and adherence to software product standards, processes, and
procedures. SQA includes the process of assuring that standards and procedures are established and are
followed throughout the software acquisition life cycle. Compliance with agreed-upon standards and procedures
is evaluated through process monitoring, product evaluation, and audits. Software development and control
processes should include quality assurance approval points, where an SQA evaluation of the product may be
done in relation to the applicable standards. The 2 types available are : Operational assurance (that specified
that the operation compiles with the required) and Life-Cycle assurance (that specifies that the system has
passed through all the Software life-cycle).
Q1187
Why does compiled code pose more risk than interpreted code?
A. Because malicious code can be embedded in the compiled code and can be difficult to detect.
B. Because the browser can safely execute all interpreted applets.
C. Because compilers are not reliable.
D. It does not. Interpreted code poses more risk than compiled code.
Answer: A
Explanation: Since the compiled code has already been translated to binary language (the language
understanded natively by the computers), its very difficult for us (the humans) to detect malicious code inside
an application, this is because its not apparently visible, you have to find that malicious code through the
behavior of the program. Instead, when we talk about Interpreted code, we use a language interpreter, that is a
piece of software that allows the end-user to write a program in some human-readable language, and have this
program executed directly by the interpreter.
This is in contrast to language compilers, that translate the human-readable code into machine- readable code,
so that the end-user can execute the machine-readable code at a later time. This is far more easier to detect
malicious code inside the programs, you just need to see what piece of code produced the undesired action.
561
ISC CISSP Exam
Q1188
Which model, based on the premise that the quality of a software product is a direct function of the quality of its
associated software development and maintenance processes, introduced five levels with which the maturity of
an organization involved in the software process is evaluated?
A. The Total Quality Model (TQM)
B. The IDEAL Model
C. The Software Capability Maturity Model
D. The Spiral Model
Answer: C
Explanation: The Capability Maturity Model for Software describes the principles and practices underlying
software process maturity and is intended to help software organizations improve the maturity of their software
processes in terms of an evolutionary path from ad hoc, chaotic processes to mature, disciplined software
processes. The CMM is organized into five maturity levels:
1) Initial. The software process is characterized as ad hoc, and occasionally even chaotic. Few processes are
defined, and success depends on individual effort and heroics.
2) Repeatable. Basic project management processes are established to track cost, schedule, and functionality.
The necessary process discipline is in place to repeat earlier successes on projects with similar applications.
3) Defined. The software process for both management and engineering activities is documented,
standardized, and integrated into a standard software process for the organization. All projects use an
approved, tailored version of the organization’s standard software process for developing and maintaining
software.
4) Managed. Detailed measures of the software process and product quality are collected. Both the software
process and products are quantitatively understood and controlled.
5) Optimizing. Continuous process improvement is enabled by quantitative feedback from the process and from
piloting innovative ideas and technologies.
Q1189
562
ISC CISSP Exam
Phreakers are hackers who specialize in telephone fraud. What type of telephone fraud simulates the tones of
coins being deposited into a payphone?
A. Red Boxes
B. Blue Boxes
C. White Boxes
D. Black Boxes
Answer: A
Explanation: The Red box basically simulates the sounds of coins being dropped into the coin slot of a
payphone. The traditional Red Box consisting of a pair of Wien-bridge oscillators with the timing controlled by
555 timer chips.
The Blue Box, The mother of all boxes, The first box in history, which started the whole phreaking scene.
Invented by John Draper (aka “Captain Crunch”) in the early 60s, who discovered that by sending a tone of
2600Hz over the telephone lines of AT&T, it was possible to make free calls. A Black Box is a device that is
hooked up to your phone that fixes your phone so that when you get a call, the caller doesn’t get charged for
the call. This is good for calls up to 1/2 hour, after 1/2 hour the Phone Co. gets suspicious, and then you can
guess what happens. The White Box turns a normal touch tone keypad into a portable unit. This kind of box
can be commonly found in a phone shop.
Q1190
What is the proper term to refer to a single unit of Ethernet data?
A. Ethernet segment
B. Ethernet datagram
C. Ethernet frame
D. Ethernet packet
Answer: C
Explanation: Ethernet traffic is transported in units of a frame, where each frame has a definite beginning and
end. Here is an Ethernet frame:
563
ISC CISSP Exam
In this picture we define:
Q1191
Which of the following represents an ALE calculation?
A. Singe loss expectancy x annualized rate of occurrence.
B. Gross loss expectancy x loss frequency.
C. Actual replacement cost proceeds of salvage.
D. Asset value x loss expectancy.
Answer: A
Explanation: ALE (Annualized Loss Expectancy) calculations are a component of every risk analysis process.
ALE calculations when done properly portray risk accurately. ALE calculations provide meaningful cost/benefit
analysis. ALE calculations are used to:
SLE x ARO = ALE
Q1192
IF an operating system permits executable objects to be used simultaneously by multiple users without a
refresh of the objects, what security problem is most likely to exist?
564
ISC CISSP Exam
A. Disclosure of residual data.
B. Unauthorized obtaining of a privileged execution state.
C. Data leakage through covert channels.
D. Denial of service through a deadly embrace.
Answer: A
Explanation: This is a well known issue knew by many programmers, since the operating system is allowing the
executables to be used by many users in different sessions at the same time, and there is not refreshing every
certain time, there will be a disclosure of residual data. To fix this we need to get sure that objects are refreshed
frequently, for added security its better an OS that does not allow the use of an executable object by many
users at the same time.
Q1193
Tape arrays use a large device with multiple (sometimes 32 or 64) tapes that are configured as a?
A. Single array
B. Dual array
C. Triple array
D. Quadruple array
Answer: A
Explanation: This is the function of a tape robot/changer working on a media library / jukebox. We can get as
many as 32 / 64 or even more tapes action as a single logical unit. You can have a robot that changes and
retrieves the different tapes when they are needed, so you see the whole bunch of tapes as it’s a single logical
storage solution for you. This kind of solutions are very expensive.
Q1194
Why would anomaly detection IDSs often generate a large number of false positives?
565
ISC CISSP Exam
A. Because they can only identify correctly attacks they already know about.
B. Because they are application-based are more subject to attacks.
C. Because they cant identify abnormal behavior.
D. Because normal patterns of user and system behavior can vary wildly.
Answer: D
Explanation: One of the most obvious reasons why false alarms occur is because tools are stateless. To detect
an intrusion, simple pattern matching of signatures is often insufficient. However, that’s what most tools do.
Then, if the signature is not carefully designed, there will be lots of matches. For example, tools detect attacks
in sendmail by looking for the words “DEBUG” or “WIZARD” as the first word of a line. If this is in the body of
the message, it’s in fact innocuous, but if the tool doesn’t differentiate between the header and the body of the
mail, then a false alarm is generated.
Finally, there are many events happening in the course of the normal life of any system or network that can be
mistaken for attacks. A lot of sysadmin activity can be catalogued as anomalous. Therefore, a clear correlation
between attack data and administrative data should be established to cross-check that everything happening
on a system is actually desired. Normal patterns and user activities are usually confused with attacks by IDS
devices, its expected that the 2nd generations IDS systems will decrease the percent of false positives.
Q1195
According to private sector data classification levels, how would salary levels and medical information be
classified?
A. Public
B. Sensitive
C. Private
D. Confidential
Answer: C
Explanation: According to the classification levels of the private sector, this information is classified as Private
because this information is from a personal nature. There is no need for other employees to see details about
your health or you salary range, this can lead to internal problems inside the company, problems like jealous
employees.
566
ISC CISSP Exam
Q1196
Which of the following is used in database information security to hide information?
A. Inheritance
B. Polyinstantiation
C. Polymorphism
D. Delegation
Answer: B
Explanation: Polyinstantiation represents an environment characterized by information stored in more than one
location in the database. This permits a security model with multiple levels-of-view and authorization. The
current problem with polyinstantiation is ensuring the integrity of the information in the database. Without an
effective method for the simultaneous updating of all occurrences of the same data element – integrity cannot
be guaranteed.
Q1197
Which of the following evaluates the product against the specification?
A. Verification
B. Validation
C. Concurrence
D. Accuracy
Answer: A
Explanation: This is the proper term, “Verification”, this term is used when we are making a comparison of a
product against a specification. For example, you can have a product that is build on open standards, you can
have a proof of that by making a “verification” of it against the standards or specifications included in those.
567
ISC CISSP Exam
Q1198
Application Level Firewalls are commonly a host computer running proxy server software, which makes a?
A. Proxy Client
B. Proxy Session
C. Proxy System
D. Proxy Server
Answer: D
Explanation: A proxy server is a server that sits between a client and server application, such as a Web
browser and a source web server. It intercepts all requests to the real server to see if it can fulfill the requests
itself. If not, it forwards the request to the original source web server. Firewalls usually provides this kind of
services to have more control over user request and allow / deny the traffic of those through the gateway. At
this time the most common Proxy server is for HTTP protocol, we can also have proxies for SMTP and FTP.
Q1199
What attack involves the perpetrator sending spoofed packet(s) with the SYN flag set to the victim’s machine
on any open port that is listening?
A. Bonk attack
B. Land attack
C. Teardrop attack
D. Smurf attack
Answer: B
Explanation: The Land attack involves the perpetrator sending spoofed packet(s) with the SYN
568
ISC CISSP Exam
flag set to the victim’s machine on any open port that is listening. If the packet(s) contain the same destination
and source IP address as the host, the victim’s machine could hang or reboot. In addition, most systems
experience a total freeze up, where as CTRL-ALT-DELETE fails to work, the mouse and keyboard become non
operational and the only method of correction is to reboot via a reset button on the system or by turning the
machine off.
Vulnerable Systems:
This will affect almost all Windows 95, Windows NT, Windows for Workgroups systems that are not properly
patched and allow Net Bios over TCP/IP.
In addition, machines running services such as HTTP, FTP, Identd, etc that do not filter packet(s), that contain
the same source / destination IP address, can still be vulnerable to attack through those ports.
Prevention:
This attack can be prevented for open / listening ports by filtering inbound packets containing the same source /
destination IP address at the router or firewall level. For most home users not running a lot of services, and for
those who use IRC, disabling the Identd server within their client will stop most attacks since the identd service
(113) is becoming the most attacked service/port.
Q1200
The beginning and the end of each transfer during asynchronous communication data transfer are marked by?
A. Start and Stop bits.
B. Start and End bits.
C. Begin and Stop bits.
D. Start and Finish bits.
Answer: A
Explanation: The ASYNCHRONOUS (ASYNC) format for data transmission is a procedure or protocol in which
each information CHARACTER or BYTE is individually synchronized or FRAMED by the use of Start and Stop
Elements, also referred to as START BITS and STOP BITS. The Asynchronous Transmission Format is also
known as START-STOP mode or CHARACTER mode. Each character or byte is framed as a separate and
independent unit of DATA that may be transmitted and received at irregular and independent time intervals.
The characters or bytes may also be transmitted as a contiguous stream or series of characters.
569
ISC CISSP Exam
Q1201
Most of unplanned downtime of information systems is attributed to which of the following?
A. Hardware failure
B. Natural disaster
C. Human error
D. Software failure
Answer: A
Explanation: This is what the static’s says. Most of the downtime is cause of unexpected hardware failure.
Commonly you just replace the FRU (Field replazable unit) when they fail. Usually a well written software does
not fail if the hardware is running correctly. The human errors are controllable and natural disasters are not very
often. Hardware failure is very common, it’s a good practice to have spare disks, NIC and any other hardware
FRU´s in your company to minimize the downtime with quick replacements.
Q1202
Raid that functions as part of the operating system on the file server
A. Software implementation
B. Hardware implementation
C. Network implementation
D. Netware implementation
Answer: A
Explanation: This kind of RAID is totally depended on the operating system, this is because the server does not
have any special hardware – RAID controller in the board. This kind of RAID implementation usually degrades
performance because it takes many CPU cycles. A very
570
ISC CISSP Exam
common example of software RAID is the support for it on Windows 2000 Server, where you can create RAID
0,1 and 5 through heterogeneous disks, you can even make a RAID between one SCSI and one EIDE disk.
The software implementation is hardware independent always that the disks are recognized by the Operating
System.
Q1203
During which phase of an IT system life cycle are security requirements developed?
A. Operation
B. Initiation
C. Development
D. Implementation
Answer: B
Explanation: In this phase, user needs are identified and the basic security objectives of the product are
acknowledged. It must be determined if the product will be processing sensitive data, and if so, the levels of
sensitivity involved should be defined. An initial risk analysis should be initiated that evaluates threats and
vulnerabilities to estimate the cost/ benefit ratios of the different security countermeasures. Issues pertaining to
security integrity, confidentiality, and availability need to be addressed. The level of each security attribute
should be focused upon so a clear direction of security controls can begin to take shape. A basic security
framework is designed for the project to follow, and risk management processes are established. Risk
management will continue throughout the lifetime of the project. Risk information may start to be gathered and
evaluated in the project initiation phase, but it will become more granular in nature as the phases graduate into
the functional design and design-specification phase.
Q1204
Ensuring that printed reports reach proper users and that receipts are signed before releasing
571
ISC CISSP Exam
sensitive documents are examples of?
A. Deterrent controls
B. Output controls
C. Information flow controls
D. Asset controls
Answer: B
Explanation: Since we want to deal with printer reports, we are talking about output controls, Why, because
printer produce output, and we can control it. As a best practice you can have people dedicated in the company
to receive the different print jobs in the printing center, and people that takes care of the confidential information
requiring a signature from the sender stating that the document was delivered to the owner in a timely and
secure fashion.
Q1205
Non-Discretionary Access Control. A central authority determines what subjects can have access to certain
objects based on the organizational security policy. The access controls may be based on?
A. The societies role in the organization.
B. The individual’s role in the organization.
C. The group-dynamics as they relate to the individual’s role in the organization.
D. The group-dynamics as they relate to the master-slave role in the organization.
Answer: B
Explanation: An access control model defines a computer and/or network system’s rules for user access to
information resources. Access control models provide confidentiality, integrity and also provide accountability
through audit trails. An audit trail documents the access of an object by a subject with a record of what
operations were performed. Operations include: read, write, execute and own.
Non-Discretionary Access Control is usually role-based, centrally administered with authorization decisions
based on the roles individuals have within an organization (e.g. bank teller, loan officer, etc. in a banking
model). A system’s security administrator grants and/or revokes system privileges based on a user’s role. This
model works well for corporations with a large turnover of
572
ISC CISSP Exam
personnel.
Q1206
An effective information security policy should not have which of the following characteristics?
A. Include separation of duties.
B. Be designed with a short-to mid-term focus.
C. Be understandable and supported by all stakeholders.
D. Specify areas of responsibility and authority.
Answer: B
Explanation: This is not a very good practice, specially for the CISSP examination, when you plan and develop
the security policy for your enterprise you should always plan it with a long term focus. The policy should be
created to be there for a long time, and you should only make revisions of it every certain time to comply with
changes or things that could have changed. In a security policy the duties should be well specified, be
understandable by the people involved in it, and specify areas of responsibility.
Q1207
Which of the following statements pertaining to secure information processing facilities is incorrect?
A. Walls should have an acceptable fire rating.
B. Windows should be protected by bars.
C. Doors must resist forcible entry.
D. Location and type of fire suppression systems should be known.
Answer: B
573
ISC CISSP Exam
Explanation: The correct answer can be determined through elimination. We need to have an acceptable fire
rating for the walls, this is well known for any CISSP aspirant, its like that because we need to contain the fire
as much as we can. We also need resistant doors so unauthorized people do not enter easily using the force.
The people also need to know about fire suppression systems to be able to deal with a fire situation inside the
facilities. As you can see, We should not protect windows with bars, this is a bad practice because, in the case
of a fire, the people cannot get out of the building through the windows.
Q1208
Making sure that the data is accessible when and where it is needed is which of the following?
A. Confidentiality
B. Integrity
C. Acceptability
D. Availability
Answer: D
Explanation: This is one of the pillars of network security. We can say that the data is available if we can access
to it when we need it. This what is referred in the question, Availability refers to get access to data when and
where you need it. Confidentiality deals with encryption and data protection against third party interception.
Integrity deals with digital signatures and assures that the data has not changed. Acceptability is not a related
term.
Q1209
Business continuity plan development depends most on?
A. Directives of Senior Management
B. Business Impact Analysis (BIA)
574
ISC CISSP Exam
C. Scope and Plan Initiation
D. Skills of BCP committee
Answer: B
Explanation: Business continuity is of course a vital activity. However, prior to the creation of a business
continuity plan, it is essential to consider the potential impacts of disaster and to understand the underlying
risks. It is now widely accepted that both business impact analysis and risk analysis are vital components of the
business continuity process. However, many organizations are unsure of how to approach these important
disciplines. BIA is important because it provides management level analysis by which an organization assesses
the quantitative (financial) and qualitative (non-financial) impacts, effects and loss that might result if the
organization were to suffer a Business Continuity E/I/C. The findings from a BIA are used to make decisions
concerning Business Continuity Management strategy and solutions.
Q1210
Which layer defines the X.25, V.35, X,21 and HSSI standard interfaces?
A. Transport layer
B. Network layer
C. Data link layer
D. Physical layer
Answer: D
Explanation: The Physical Layer is the layer that is concerned with the signaling of the message and the
interface between the sender or receiver and the medium. The physical layer is generally defined by one of the
standards bodies and carries a designation that indicates the characteristics of the connection. Among
frequently used physical layers standards are EIA-232-D, ITU V.35, and some of the X series (X.21/X.21bis, for
example).
Q1211
Related to information security, availability is the opposite of which of the following?
575
ISC CISSP Exam
A. Delegation
B. Distribution
C. Documentation
D. Destruction
Answer: D
Explanation: This is the correct term, remember that Availability refers to get access to data when and where
you need it. When we talk about destruction, we are saying the opposite, if your information is destroyed, you
cant access to it neither when or where you want it. Delegation deals with permissions, distribution deals with
deployment and documentation deals with information and how to´s. The term we are looking here is definitively
“destruction”.
Q1212
Which of the following is a disadvantage of a behavior-based ID system?
A. The activity and behavior of the users while in the networked system may not be static enough to effectively
implement a behavior-based ID system.
B. The activity and behavior of the users while in the networked system may be dynamic enough to effectively
implement a behavior-based ID system.
C. The activity and behavior of the users while in the networked system may not be dynamic enough to
effectively implement a behavior-based ID system.
D. The system is characterized by high false negative rates where intrusions are missed.
Answer: A
Explanation: Behavior-based intrusion detection techniques assume that an intrusion can be detected by
observing a deviation from normal or expected behavior of the system or the users. The model of normal or
valid behavior is extracted from reference information collected by various means. The intrusion detection
system later compares this model with the current activity. When a deviation is observed, an alarm is
generated. In other words, anything that does not correspond to a previously learned behavior is considered
intrusive. The high false alarm rate is generally cited as the main drawback of behavior-based techniques
because the entire scope of the behavior of an information system may not be covered during the learning
phase. Also, behavior can change over time, introducing the need for periodic online retraining of the behavior
profile, resulting either in unavailability of the intrusion detection system or in additional false alarms. To get the
most out of this kind of IDS you need to have very static behavior on your network and the user actions, this is
because any new thing is considered dangerous, providing many false-positives but increased
576
ISC CISSP Exam
security. If you are in a very “dynamic” environment these kind of IDS system is not recommended.
Q1213
Which of the following statements pertaining to VPN protocol standards is false?
A. L2TP is a combination of PPTP and L2F.
B. L2TP and PPTP were designed for single point-to-point client to server communication.
C. L2TP operates at the network layer.
D. PPTP uses native PPP authentication and encryption services.
Answer: C
Explanation: The Layer 2 Tunnel Protocol (L2TP) is an emerging Internet Engineering Task Force (IETF)
standard that combines the best features of two existing tunneling protocols: Cisco’s Layer 2 Forwarding (L2F)
and Microsoft’s Point-to-Point Tunneling Protocol (PPTP). L2TP is an extension to the Point-to-Point Protocol
(PPP), which is an important component for VPNs. VPNs allow users and telecommuters to connect to their
corporate intranets or extranets. VPNs are cost- effective because users can connect to the Internet locally and
tunnel back to connect to corporate resources. This not only reduces overhead costs associated with traditional
remote access methods, but also improves flexibility and scalability. PPTP and L2TP are Layer 2 tunneling
protocols; both encapsulate the payload in a Point-to-Point Protocol (PPP) frame to be sent across an
intermediate network.
Q1214
What is the most critical characteristic of a biometric identifying system?
A. Perceived intrusiveness
B. Storage requirements
577
ISC CISSP Exam
C. Accuracy
D. Reliability
Answer: C
Explanation: The principle of biometrics is to use some unique characteristic to identify whether the person is
who they say they are. Biometrics works by matching or verifying a person’s unique traits with stored data in two
categories: physiological characteristics and those that are behavioral. Physical indicators include iris,
fingerprint, facial, or hand geometry. Behavior types are usually voiceprints, keystroke dynamics and
handwritten signatures. Most biometric technologies require special hardware to convert analog measurements
of signatures, voices, or patterns of fingerprints and palm prints, to digital measurement, which computers can
read. The biggest characteristic and problem of biometric implementations today is the accuracy, we must see
the level of accuracy before buying a solution, because the technology is not perfect at this time and it can be
erroneous sometimes.
Q1215
RAID Software can run faster in the operating system because neither use the hardware-level parity drives by?
A. Simple striping or mirroring.
B. Hard striping or mirroring.
C. Simple hamming code parity or mirroring.
D. Simple striping or hamming code parity.
Answer: A
Explanation: This is true, if we do not use parity in our RAID implementation, like RAID 1 (Mirroring) or RAID 0
(Stripping) we can improve performance because the CPU does not need waste cycles to make the parity
calculations. For example this can be achieved in Windows 2000 server through the use of RAID 0 (No fault
tolerance, just stripping in 64kb chunks) or RAID 1 (Mirroring through a file system driver). This is not the case
of RAID 5 that actually use parity to provide fault tolerance.
578
ISC CISSP Exam
Q1216
The guarantee that the message sent is the message received, and that the message was not intentionally or
unintentionally altered is?
A. Integrity
B. Confidentiality
C. Availability
D. Identity
Answer: A
Explanation: Here are 2 definitions for Data Integrity:
Availability refers to get access to data when and where you need it. Confidentiality deals with encryption and
data protection against third party interception. Identity deals with authentication.
Q1217
Which of the following is a preventive control?
A. Motion detectors
B. Guard dogs
C. Audit logs
D. Intrusion detection systems
Answer: B
Explanation: This is very obvious. Since we want to prevent something from happening, we can go out and buy
some Guard dogs to make the job. You are buying them because you want to prevent something from
happening. The intruder will see the dogs and will maybe go back, this prevents an attack, this dogs are a form
of preventive control. Motion Detectors and IDS are real- time, Audit Logs are passive.
579
ISC CISSP Exam
Q1218
What uses a key of the same length as the message?
A. Running key cipher
B. One-time pad
C. Steganography
D. Cipher block chaining
Answer: B
Explanation: The one time pad is the most secure, and one of the simplest of all cryptographic methods. It was
invented and patented just after World War I by Gilbert Vernam (of AT&T) and Joseph Mauborgne (USA, later
chief of the Signal Corps). The fundamental features are that the sender and receiver each have a copy of an
encryption key, which is as long as the message to be encrypted, and each key is used for only one message
and then discarded. That key must be random, that is without pattern, and must remain unknown to any
attacker. In addition, the key must never be reused, otherwise the cipher becomes trivially breakable. One of its
features it’s the key length, it’s the same as the message.
Q1219
Which of the following protocols operates at the session layer (layer 5)?
A. RPC
B. IGMP
C. LDP
D. SPX
Answer: A
Explanation: The socket method of network use is a message-based system, in which one process writes a
message to another. This is a long way from the procedural model. The remote procedure call is intended to
act like a procedure call, but to act across the network transparently. The process makes a remote procedure
call by pushing its parameters and a return
580
ISC CISSP Exam
address onto the stack, and jumping to the start of the procedure. The procedure itself is responsible for
accessing and using the network. After the remote execution is over, the procedure jumps back to the return
address. The calling process then continues. RPC works at the Session layer of the OSI model.
Q1220
Which of the following are NOT a countermeasure to traffic analysis?
A. Padding messages
B. Eavesdropping
C. Sending noise
D. Covert channel analysis
Answer: B
Explanation: Lets do this with a elimination process. With padding messages you can countermeasure traffic
analysis because you add garbage information to the message to let in end in a fixed length, this can confuse
the analyzer. Sending noise on the communication line could also countermeasure analysis because the
analyzer don’t now how to differentiate between real information and noise. You can also covert channel
analysis. Eavesdropping does not apply in this situation, its not considered a counter measure to traffic
analysis.
Q1221
Which of the following layers of the ISO/OSI model do packet filtering firewalls operate at?
A. Application layer
B. Session layer
C. Network layer
D. Presentation layer
581
ISC CISSP Exam
Answer: C
Explanation: Packet filtering firewalls work at the network level of the OSI model, or the IP layer of TCP/IP.
These firewalls are normally part of a router, which is a device that receives and forwards packets to networks.
“In a packet filtering firewall each packet is compared to a set of criteria before it is forwarded. Depending on
the packet and the criteria, the firewall can drop the packet, forward it, or send a message to the originator.”
The criteria used to evaluate a packet include source, destination IP address, destination port, and protocol
used. These types of firewalls are low in cost and don’t have much of an impact on the network’s performance.
Q1222
A prolonged high voltage is?
A. Spike
B. Blackout
C. Surge
D. Fault
Answer: C
Explanation:
Q1223
How do the Information Labels of Compartmented Mode Workstation differ from the Sensitivity Levels of B3
evaluated systems?
A. Information Labels in CMW are homologous to Sensitivity Labels, but a different term was chosen to
emphasize that CMW’s are not described in the Orange Book.
B. Information Labels contain more information than Sensitivity Labels, thus allowing more granular access
decisions to be made.
C. Sensitivity Labels contain more information than Information Labels because B3+ systems should store
more sensitive data than workstations.
582
ISC CISSP Exam
D. Information Labels contain more information than Sensitivity Labels, but are not used by the Reference
Monitor to determine access permissions.
Answer: D
Explanation: The primary goal of the compartmented mode workstation (CMW) project was to articulate the
security requirements that workstations must meet to process highly classified intelligence data. As a basis for
the validity of the requirements developed, a prototype was implemented which demonstrated that workstations
could meet the requirements in an operationally useful manner while still remaining binary compatible with offthe-
shelf software. The security requirements not only addressed traditional security concerns but also
introduced concepts in areas such as labeling and the use of a trusted window management system. The CMW
labeling paradigm is based on associating two types of security labels with objects:
sensitivity levels and information labels. Sensitivity levels describe the levels at which objects must be
protected. Information labels are used to prevent data over classification and also provide a mechanism for
associating with data those markings that are required for accurate data labeling, but which play no role in
access control decisions. The use of a trusted window manager allows users to easily operate at multiple
sensitivity levels and provides a convenient mechanism for communicating security information to users in a
relatively unobtrusive manner. Information labels are not used by reference monitor, permissions are
referenced in Sensibility labels.
Q1224
In what security mode can a system be operating if all users have the clearance or authorization and need-toknow
to all data processed within the system?
A. Dedicated security mode.
B. System-high security mode.
C. Compartmented security mode.
D. Multilevel security mode.
Answer: A
Explanation: An information-system (IS) security mode of operation wherein each user with direct or indirect
access to the system, its peripherals, remote terminals, or remote hosts, has all of the following: (a) a valid
security clearance for all information within the system; (b) formal access approval and signed nondisclosure
agreements for all the information stored and/or processed (including all compartments, sub compartments,
and/or special access programs); and (c) a valid
583
ISC CISSP Exam
need-to-know for all information contained within the IS. When in the dedicated security mode, a system is
specifically and exclusively dedicated to and controlled for the processing of one particular type or classification
of information, either for full-time operation or for a specified period of time.
Q1225
What are the three conditions that must be met by the reference monitor?
A. Confidentiality, availability and integrity.
B. Policy, mechanism and assurance.
C. Isolation, layering and abstraction.
D. Isolation, completeness and verifiability.
Answer: D
Explanation: These are three of the main characteristics of a Reference Monitor. You need Isolation, because it
cant be of public access, the less access the better. It must have a sense of completeness to provide the whole
information and process cycles. It must be verifiable, to provide security, audit and accounting functions.
Q1226
While referring to Physical Security, what does Positive pressurization means?
A. The pressure inside your sprinkler system is greater than zero.
B. The air goes out of a room when a door is opened and outside air does not go into the room.
C. Causes the sprinkler system to go off.
D. A series of measures that increase pressure on employees in order to make them more productive.
Answer: B
584
ISC CISSP Exam
Explanation: Positive Pressurization is a condition that exists when more air is supplied to a space than is
exhausted, so the air pressure within that space is greater than that in surrounding areas. This condition can
cause the situation mentioned above in the answer B, you can make air go out of a room but not enter to it from
the outside.
Q1227
The baseline sets certain thresholds for specific errors or mistakes allowed and the amount of these
occurrences that can take place before it is considered suspicious?
A. Checkpoint level
B. Ceiling level
C. Clipping level
D. Threshold level
Answer: C
Explanation: According to CISSP documentation, this is the proper term, The Clipping level is used to
determine suspicious occurrences that are a production of errors or mistakes. Checkpoint level is not a related
term. Ceiling level is not related to baselines. Threshold level is attractive, but is not the correct term. Take a
look at your CISSP documentation.
Q1228
The most prevalent cause of computer center fires is which of the following?
A. AC equipment
B. Electrical distribution systems.
C. Heating systems
D. Natural causes
Answer: B
585
ISC CISSP Exam
Explanation: According to static’s, this is the greatest cause, Electrical distribution systems, specially those not
installed through standards are very prone to fail and make fire inside places. AC equipment its not very prone
to make fire. Natural causes it’s a possibility but is definitively not the most prevalent cause. Heating systems
are a very rare case of Fire beginners.
Q1229
An offsite backup facility intended to operate an information processing facility, having no computer or
communications equipment, but having flooring, electrical writing, air conditioning, etc. Is better known as a?
A. Hot site
B. Duplicate processing facility
C. Cold site
D. Warm site
Answer: C
Explanation: A cold site has all the appropriate power requirements, and floor space to install the hardware and
to enable you to recreate your computer environment, but does not provide the actual equipment. Many of the
companies that provide hot sites also provide cold sites. It may be reasonable for your company to consider
creating its won cold site if your company has floor space available in another location than the home site. They
require much more outage than Hot sites before operations can be restored.
Q1230
Which of the following are necessary components of a Multi-Level Security Policy?
A. Sensitivity Labels and a “system high” evaluation.
B. Sensitivity Labels and Discretionary Access Control.
C. Sensitivity Labels and Mandatory Access Control.
586
ISC CISSP Exam
D. Object Labels and a “system high” evaluation.
Answer: C
Explanation: First implemented in Military organizations (and I think even today it’s implemented there only), this
model was a significant improvement in terms of security policy implementation. This model made
implementation of complex security policies very simple. It’s specifications are present in the orange book from
DoD. In this model, every object is assigned a sensitivity label. Also, every user is assigned a sensitivity label. If
a user’s sensitivity label is greater than or equal to the sensitivity label, he is allowed access to the object,
otherwise, he is denied access. This methodology is used for creating a hierarchy of access. We can say that
this method is used for partitioning the organization hierarchy horizontally.
Multi-Level Security is considered a Mandatory Access Control method.
Q1231
Which of the following, used to extend a network, has a storage capacity to store frames and act as a storeand-
forward device?
A. Bridge
B. Router
C. Repeater
D. Gateway
Answer: A
Explanation: A bridge is a network device that connects two similar network segments together. The primary
function of a bridge is to keep traffic separated on both sites of the bridge. Traffic is allowed to pass through the
bridge only if the transmission is intended for a station in the opposite side. Bridges operate at the data link
layer of the OSI model an provides two different collision domains in Ethernet, but they only provide one
broadcast domain for layer 3 an up of the OSI model. The bridge can store frames and forward them in many
forms like Cut-through and Store and Forward.
587
ISC CISSP Exam
Q1232
Which of the following is addressed by Kerberos?
A. Authorization and authentication.
B. Validation and integrity.
C. Confidentiality and integrity.
Answer: C
Explanation: Kerberos is a network authentication protocol. It is designed to provide strong authentication for
client/server applications by using secret-key cryptography. A free implementation of this protocol is available
from the Massachusetts Institute of Technology. Kerberos is available in many commercial products as well.
Kerberos was created by MIT as a solution to these network security problems. The Kerberos protocol uses
strong cryptography so that a client can prove its identity to a server (and vice versa) across an insecure
network connection. After a client and server has used Kerberos to prove their identity, they can also encrypt
(confidentiality) all of their communications to assure privacy and data integrity as they go about their business.
Q1233
Access Control techniques do not include which of the following choices?
A. Relevant Access Controls
B. Discretionary Access Control
C. Mandatory Access Control
D. Lattice Based Access Control
Answer: A
Explanation: Relevant Access Controls are not included as a Access Control Technique. Lattice-based access
control models were developed in the early 1970s to deal with the confidentiality of military information. In the
late 1970s and early 1980s, researchers applied these models to certain integrity concerns. Later, application of
the models to the Chinese Wall policy, a confidentiality policy unique to the commercial sector, was
demonstrated. Discretionary control is the most common type of access control mechanism implemented in
computer systems today. The basis of this kind of security is that an individual user, or program
588
ISC CISSP Exam
operating on the user’s behalf, is allowed to specify explicitly the types of access other users (or programs
executing on their behalf) may have to information under the user’s control. Discretionary Access control
security differs from mandatory access control security in that it implements the access control decisions of the
user. Mandatory controls are driven by the results of a comparison between the user’s trust level or clearance
and the sensitivity designation of the information.
Q1234
Why is public key cryptography recommended for use in the process of securing facsimiles during
transmission?
A. Keys are never transmitted over the network.
B. Data compression decreases key change frequency.
C. Key data is not recognizable from facsimile data.
D. The key is securely passed to the receiving machine.
Answer: D
Explanation: In this method of cryptography we use 2 keys, one to encrypt the data, and another to decrypt it. In
Public Key Cryptography, the users have a public and a private key, the public key is of free distribution and is
usually published in a directory, while the private keys must be keep secure. This allows the keys to pass in a
secure fashion to the receiving machine, its because the public key is not confidential and can be send through
a secure channel. You need to use a certification authority to make this kind of cryptography work.
Q1235
Database views are not used to:
A. Implement referential integrity.
589
ISC CISSP Exam
B. Implement least privilege.
C. To implement content-dependent access restrictions.
D. Implement need-to-know.
Answer: A
Explanation: A View is a display of one or more table shows that shows the table data. You can even retrieve
part of the table and display the same to the user. Before a user is able to use a view, they must have both,
permission on the view and all dependent objects. Views can also be used to implement security, for example
you can create a view that only shows 3 of 5 columns contained in a table. Views are not used to provide
integrity you can use constraints, rule or other components of database systems.
Q1236
Which of the following is most concerned with personnel security?
A. Management controls
B. Operational controls
C. Technical controls
D. Human resources controls.
Answer: B
Explanation: Personnel security always have to deal more with Operational controls, Operational controls
provide the guidelines and the correct procedures to implement the different operations. Management controls
are usually used only by managers. Human resources and Technical Controls are not related to personal
security as the question states. See the different control definitions in your CISSP documentation.
Q1237
Which of the following statements pertaining to the Trusted Computer System Evaluation Criteria (TCSEC) is
incorrect?
590
ISC CISSP Exam
A. With TCSEC, functionality and assurance are evaluated separately.
B. TCSEC provides a means to evaluate the trustworthiness of an information system.
C. The Orange book does not cover networks and communications.
D. Data base management systems are not covered by the TCSEC.
Answer: A
Explanation: TCSEC does not separate functionality and assurance from evaluation. It makes them a combined
criteria. Just to remember, The Trusted Computer System Evaluation Criteria (TCSEC) is a collection of criteria
used to grade or rate the security offered by a computer system product. The TCSEC is sometimes referred to
as “the Orange Book” because of its orange cover (Orange Book deals with networks and communications).
The current version is dated 1985 (DOD 5200.28-STD, Library No.S225,711) The TCSEC, its interpretations
and guidelines all have different color covers, and are sometimes known as the “Rainbow Series”. Database
management is also covered in TCSEC.
The Orange Book is used to evaluate whether a product contains the security properties the vendor claims it
does and whether the product is appropriate for a specific application or function. The Orange Book is used to
review the functionality, effectiveness, and assurance of a product during its evaluation, and it uses classes that
were devised to address typical patterns of security requirements.
Shon Harris, “CISSP All-in-One Exam Guide”, 3rd Ed, p 302.
Q1238
Which of the following could illegally capture network user passwords?
A. Data diddling
B. Sniffing
C. Spoofing
D. Smurfing
Answer: B
Explanation: Sniffing is the action of capture the information going over the network. Most popular way of
connecting computers is through Ethernet. Ethernet protocol works by sending packet information to all the
hosts on the same circuit. The packet header contains the proper address of the destination machine. Only the
machine with the matching address is suppose to accept the packet. A machine that is accepting all packets,
no matter what the packet header says, is said to be in promiscuous mode. Because, in a normal networking
environment,
591
ISC CISSP Exam
account and password information is passed along Ethernet in clear-text, it is not hard for an intruder to put a
machine into promiscuous mode and by sniffing, compromise all the machines on the net by capturing
password in an illegal fashion.
Q1239
Which trusted facility management concept implies that two operators must review and approve the work of
each other?
A. Two-man control
B. Dual control
C. Double control
D. Segregation control
Answer: A
Explanation: The proper te