Читать книгу (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests - Mike Chapple - Страница 11

SUBDOMAINS:

 3.1 Research, implement and manage engineering processes using secure design principles

 3.2 Understand the fundamental concepts of security models (e.g., Biba, Star Model, Bell-LaPadula)

 3.3 Select controls based upon system security requirements

 3.4 Understand security capabilities of Information Systems (IS) (e.g., memory protection, Trusted Platform Module (TPM), encryption/decryption)

 3.5 Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements

 3.6 Select and determine cryptographic solutions

 3.7 Understand methods of cryptanalytic attacks

 3.8 Apply security principles to site and facility design

 3.9 Design site and facility security controls

1 Matthew is the security administrator for a consulting firm and must enforce access controls that restrict users' access based upon their previous activity. For example, once a consultant accesses data belonging to Acme Cola, a consulting client, they may no longer access data belonging to any of Acme's competitors. What security model best fits Matthew's needs?Clark-WilsonBibaBell-LaPadulaBrewer-Nash

2 Referring to the figure shown here, what is the earliest stage of a fire where it is possible to use detection technology to identify it?IncipientSmokeFlameHeat

3 Ralph is designing a physical security infrastructure for a new computing facility that will remain largely unstaffed. He plans to implement motion detectors in the facility but would also like to include a secondary verification control for physical presence. Which one of the following would best meet his needs?CCTVIPSTurnstilesFaraday cages

4 Harry would like to retrieve a lost encryption key from a database that uses m of n control, with m = 4 and n = 8. What is the minimum number of escrow agents required to retrieve the key?24812

5 Fran's company is considering purchasing a web-based email service from a vendor and eliminating its own email server environment as a cost-saving measure. What type of cloud computing environment is Fran's company considering?SaaSIaaSCaaSPaaS

6 Bob is a security administrator with the U.S. federal government and wants to choose a digital signature approach that is an approved part of the federal Digital Signature Standard under FIPS 186-4. Which one of the following encryption algorithms is not an acceptable choice for use in digital signatures?DSAHAVALRSAECDSA

7 Harry would like to access a document owned by Sally and stored on a file server. Applying the subject/object model to this scenario, who or what is the subject of the resource request?HarrySallyServerDocument

8 Michael is responsible for forensic investigations and is investigating a medium-severity security incident that involved the defacement of a corporate website. The web server in question ran on a virtualization platform, and the marketing team would like to get the website up and running as quickly as possible. What would be the most reasonable next step for Michael to take?Keep the website offline until the investigation is complete.Take the virtualization platform offline as evidence.Take a snapshot of the compromised system and use that for the investigation.Ignore the incident and focus on quickly restoring the website.

9 Helen is a software engineer and is developing code that she would like to restrict to running within an isolated sandbox for security purposes. What software development technique is Helen using?BoundsInput validationConfinementTCB

10 What concept describes the degree of confidence that an organization has that its controls satisfy security requirements?TrustCredentialingVerificationAssurance

11 What type of security vulnerability are developers most likely to introduce into code when they seek to facilitate their own access, for testing purposes, to software they developed?Maintenance hookCross-site scriptingSQL injectionBuffer overflow

12 In the figure shown here, Sally is blocked from reading the file due to the Biba integrity model. Sally has a Secret security clearance, and the file has a Confidential classification. What principle of the Biba model is being enforced?Simple Security PropertySimple Integrity Property*-Security Property*-Integrity Property

13 Tom is responsible for maintaining the security of systems used to control industrial processes located within a power plant. What term is used to describe these systems?POWERSCADAHAVALCOBOL

14 Sonia recently removed an encrypted hard drive from a laptop and moved it to a new device because of a hardware failure. She is having difficulty accessing encrypted content on the drive despite the fact that she knows the user's password. What hardware security feature is likely causing this problem?TCBTPMNIACAPRSA

15 Chris wants to verify that a software package that he downloaded matches the original version. What hashing tool should he use if he believes that technically sophisticated attackers may have replaced the software package with a version containing a backdoor?MD53DESSHA1SHA 256For questions 16–19, please refer to the following scenario:Alice and Bob would like to use an asymmetric cryptosystem to communicate with each other. They are located in different parts of the country but have exchanged encryption keys by using digital certificates signed by a mutually trusted certificate authority.

16 If Alice wants to send Bob a message that is encrypted for confidentiality, what key does she use to encrypt the message?Alice's public keyAlice's private keyBob's public keyBob's private key

17 When Bob receives the encrypted message from Alice, what key does he use to decrypt the message's plaintext content?Alice's public keyAlice's private keyBob's public keyBob's private key

18 Which one of the following keys would Bob not possess in this scenario?Alice's public keyAlice's private keyBob's public keyBob's private key

19 Alice would also like to digitally sign the message that she sends to Bob. What key should she use to create the digital signature?Alice's public keyAlice's private keyBob's public keyBob's private key

20 What name is given to the random value added to a password in an attempt to defeat rainbow table attacks?HashSaltExtenderRebar

21 Which one of the following is not an attribute of a hashing algorithm?They require a cryptographic key.They are irreversible.It is very difficult to find two messages with the same hash value.They take variable-length input.

22 What type of fire suppression system fills with water after a valve opens when the initial stages of a fire are detected and then requires a sprinkler head heat activation before dispensing water?Wet pipeDry pipeDelugePreaction

23 Susan would like to configure IPsec in a manner that provides confidentiality for the content of packets. What component of IPsec provides this capability?AHESPIKEISAKMP

24 Which one of the following cryptographic goals protects against the risks posed when a device is lost or stolen?NonrepudiationAuthenticationIntegrityConfidentiality

25 Joanna wants to review the status of the industrial control systems her organization uses for building control. What type of systems should she inquire about access to?SCADADSSBASICS-CSS

26 In the figure shown here, Harry's request to write to the data file is blocked. Harry has a Secret security clearance, and the data file has a Confidential classification. What principle of the Bell-LaPadula model blocked this request?Simple Security PropertySimple Integrity Property*-Security PropertyDiscretionary Security Property

27 Florian and Tobias would like to begin communicating using a symmetric cryptosystem, but they have no prearranged secret and are not able to meet in person to exchange keys. What algorithm can they use to securely exchange the secret key?IDEADiffie-HellmanRSAMD5

28 Carl's organization recently underwent a user access review. At the conclusion of the review, the auditors noted several cases of privilege creep. What security principle was violated?Fail securelyKeep it simpleTrust but verifyLeast privilege

29 Matt's organization recently adopted a zero-trust network architecture. Under this approach, which one of the following criteria would be LEAST appropriate to use when granting a subject access to resources?PasswordTwo-factor authentication IP addressBiometric scan

30 Colin is the chief privacy officer for a nonprofit organization and is assisting with the team's transition to a Privacy by Design approach. Under this approach, which of the following principles should the team embrace?Proactive, not reactivePrivacy as the default settingEnd-to-end securityDefense in depth

31 What cryptographic principle stands behind the idea that cryptographic algorithms should be open to public inspection?Security through obscurityKerckhoffs' principleDefense in depthHeisenburg principle

32 Ryan is developing a physical access plan for his organization's data center and wants to implement the security control indicated by the arrow in this diagram. What is the name of this control?MantrapTurnstileIntrusion prevention systemPortal

33 Which one of the following does not describe a standard physical security requirement for wiring closets?Place only in areas monitored by security guards.Do not store flammable items in the closet.Use sensors on doors to log entries.Perform regular inspections of the closet.

34 In the figure shown here, Sally is blocked from writing to the data file by the Biba integrity model. Sally has a Secret security clearance, and the file is classified Top Secret. What principle is preventing her from writing to the file?Simple Security PropertySimple Integrity Property*-Security Property*-Integrity Property

35 Lana recently implemented a new process in her organization where managers who are responsible for granting users access to a system are not permitted to participate in access reviews. What principle is she enforcing?Two-person controlLeast privilegePrivilege creepSeparation of duties

36 Which of the following statements about system development are correct? (Select all that apply.)Systems should be designed to operate in a secure manner if the user performs no other configuration.Systems should be designed to fall back to a secure state if they experience an error.Systems should be designed to incorporate security as a design feature.Systems should be designed in a manner that keeps their functionality as simple as possible.

37 Alan is reviewing a system that has been assigned the EAL1 evaluation assurance level under the Common Criteria. What is the degree of assurance that he may have about the system?It has been functionally tested.It has been structurally tested. It has been formally verified, designed, and tested.It has been methodically designed, tested, and reviewed.

38 Jake works for a research organization that is seeking to deploy a grid computing system that will perform cycle scavenging on user workstations to conduct research tasks that require high-performance computing. What is the most significant risk associated with this operation?Data confidentialityIsolation breachData integrityData availability

39 Eimear's software development team uses an approach that creates many discrete software objects and then binds them together using APIs. What term best describes this architecture?MicroservicesFunction-as-a-serviceContainerizationVirtualization

40 Adam recently configured permissions on an NTFS filesystem to describe the access that different users may have to a file by listing each user individually. What did Adam create?An access control listAn access control entryRole-based access controlMandatory access control

41 Betty is concerned about the use of buffer overflow attacks against a custom application developed for use in her organization. What security control would provide the strongest defense against these attacks?FirewallIntrusion detection systemParameter checkingVulnerability scanning

42 Which one of the following combinations of controls best embodies the defense in depth principle?Encryption of email and network intrusion detectionCloud access security brokers (CASB) and security awareness trainingData loss prevention and multifactor authenticationNetwork firewall and host firewall

43 James is working with a Department of Defense system that is authorized to simultaneously handle information classified at the Secret and Top Secret levels. What type of system is he using?Single stateUnclassifiedCompartmentedMultistate

44 Kyle is being granted access to a military computer system that uses System High mode. What is not true about Kyle's security clearance requirements?Kyle must have a clearance for the highest level of classification processed by the system, regardless of his access.Kyle must have access approval for all information processed by the system.Kyle must have a valid need to know for all information processed by the system.Kyle must have a valid security clearance.

45 Gary intercepts a communication between two individuals and suspects that they are exchanging secret messages. The content of the communication appears to be the image shown here. What type of technique may the individuals use to hide messages inside this image?Visual cryptographySteganographyCryptographic hashingTransport layer security

46 Philip is developing a new security tool that will be used by individuals in many different subsidiaries of his organization. He chooses to use Docker to deploy the tool to simplify configuration. What term best describes this approach?VirtualizationAbstractionSimplificationContainerization

47 In the ring protection model shown here, what ring contains the operating system's kernel?Ring 0Ring 1Ring 2Ring 3

48 In an infrastructure as a service (IaaS) environment where a vendor supplies a customer with access to storage services, who is normally responsible for removing sensitive data from drives that are taken out of service?Customer's security teamCustomer's storage teamCustomer's vendor management teamVendor

49 During a system audit, Casey notices that the private key for her organization's web server has been stored in a public Amazon S3 storage bucket for more than a year. Which one of the following actions should she take first?Remove the key from the bucket.Notify all customers that their data may have been exposed. Request a new certificate using a new key.Nothing, because the private key should be accessible for validation.

50 Which one of the following systems assurance processes provides an independent third-party evaluation of a system's controls that may be trusted by many different organizations?CertificationDefinitionVerificationAccreditation

51 Darcy's organization is deploying serverless computing technology to better meet the needs of developers and users. In a serverless model, who is normally responsible for configuring operating system security controls?Software developerCybersecurity professionalCloud architectVendor

52 Harold is assessing the susceptibility of his environment to hardware failures and would like to identify the expected lifetime of a piece of hardware. What measure should he use for this?MTTRMTTFRTOMTO

53 Chris is designing a cryptographic system for use within his company. The company has 1,000 employees, and they plan to use an asymmetric encryption system. They would like the system to be set up so that any pair of arbitrary users may communicate privately. How many total keys will they need?5001,0002,0004,950

54 Gary is concerned about applying consistent security settings to the many mobile devices used throughout his organization. What technology would best assist with this challenge?MDMIPSIDSSIEM

55 Alice sent a message to Bob. Bob would like to demonstrate to Charlie that the message he received definitely came from Alice. What goal of cryptography is Bob attempting to achieve?AuthenticationConfidentialityNonrepudiationIntegrity

56 Rhonda is considering the use of new identification cards for physical access control in her organization. She comes across a military system that uses the card shown here. What type of card is this?Smart cardProximity cardMagnetic stripe cardPhase three card

57 Gordon is concerned about the possibility that hackers may be able to use the Van Eck radiation phenomenon to remotely read the contents of computer monitors in a restricted work area within his facility. What technology would protect against this type of attack?TCSECSCSIGHOSTTEMPEST

58 Jorge believes that an attacker has obtained the hash of the Kerberos service account from one of his organization's Active Directory servers. What type of attack would this enable?Golden ticketKerberoastingPass the ticketBrute force

59 Sherry conducted an inventory of the cryptographic technologies in use within her organization and found the following algorithms and protocols in use. Which one of these technologies should she replace because it is no longer considered secure?MD5AESPGPWPA3

60 Robert is investigating a security breach and discovers the Mimikatz tool installed on a system in his environment. What type of attack has likely taken place?Password crackingPass the hashMAC spoofingARP poisoning

61 Tom is a cryptanalyst and is working on breaking a cryptographic algorithm's secret key. He has a copy of an intercepted message that is encrypted, and he also has a copy of the decrypted version of that message. He wants to use both the encrypted message and its decrypted plaintext to retrieve the secret key for use in decrypting other messages. What type of attack is Tom engaging in?Chosen ciphertextChosen plaintextKnown plaintextBrute force

62 A hacker recently violated the integrity of data in James's company by modifying a file using a precise timing attack. The attacker waited until James verified the integrity of a file's contents using a hash value and then modified the file between the time that James verified the integrity and read the contents of the file. What type of attack took place?Social engineeringTOCTOUData diddlingParameter checking

63 Carl is deploying a set of video sensors that will be placed in remote locations as part of a research project. Due to connectivity limitations, he would like to perform as much image processing and computation as possible on the device itself before sending results back to the cloud for further analysis. What computing model would best meet his needs?Serverless computingEdge computingIaaS computingSaaS computing

64 What action can you take to prevent accidental data disclosure due to wear leveling on an SSD device before reusing the drive?ReformattingDisk encryptionDegaussingPhysical destruction

65 Johnson Widgets strictly limits access to total sales volume information, classifying it as a competitive secret. However, shipping clerks have unrestricted access to order records to facilitate transaction completion. A shipping clerk recently pulled all of the individual sales records for a quarter from the database and totaled them up to determine the total sales volume. What type of attack occurred?Social engineeringInferenceAggregationData diddling

66 What physical security control broadcasts false emanations constantly to mask the presence of true electromagnetic emanations from computing equipment?Faraday cageCopper-infused windowsShielded cablingWhite noise

67 In a software as a service cloud computing environment, who is normally responsible for ensuring that appropriate firewall controls are in place to protect the application?Customer's security teamVendorCustomer's networking teamCustomer's infrastructure management team

68 Alice has read permissions on an object, and she would like Bob to have those same rights. Which one of the rules in the Take-Grant protection model would allow her to complete this operation?Create ruleRemove ruleGrant ruleTake rule

69 As part of his incident response process, Charles securely wipes the drive of a compromised machine and reinstalls the operating system (OS) from original media. Once he is done, he patches the machine fully and applies his organization's security templates before reconnecting the system to the network. Almost immediately after the system is returned to service, he discovers that it has reconnected to the same botnet it was part of before. Where should Charles look for the malware that is causing this behavior?The operating system partitionThe system BIOS or firmwareThe system memoryThe installation media

70 Lauren implements ASLR to help prevent system compromises. What technique has she used to protect her system?EncryptionMandatory access controlMemory address randomizationDiscretionary access control

71 Alan intercepts an encrypted message and wants to determine what type of algorithm was used to create the message. He first performs a frequency analysis and notes that the frequency of letters in the message closely matches the distribution of letters in the English language. What type of cipher was most likely used to create this message?Substitution cipherAESTransposition cipher3DES

72 The Double DES (2DES) encryption algorithm was never used as a viable alternative to the original DES algorithm. What implementation attack is 2DES vulnerable to that does not exist for the DES or 3DES approach?Chosen ciphertextBrute forceMan-in-the-middleMeet-in-the-middle

73 Grace would like to implement application control technology in her organization. Users often need to install new applications for research and testing purposes, and she does not want to interfere with that process. At the same time, she would like to block the use of known malicious software. What type of application control would be appropriate in this situation?BlacklistingGraylistingWhitelistingBluelisting

74 Warren is designing a physical intrusion detection system for use in a sensitive media storage facility and wants to include technology that issues an alert if the communications lines for the alarm system are unexpectedly cut. What technology would meet this requirement?Heartbeat sensorEmanation securityMotion detectorFaraday cage

75 John and Gary are negotiating a business transaction, and John must demonstrate to Gary that he has access to a system. He engages in an electronic version of the “magic door” scenario shown here. What technique is John using?Split-knowledge proofZero-knowledge proofLogical proofMathematical proof

76 After scanning all of the systems on his wireless network, Mike notices that one system is identified as an iOS device running a massively out-of-date version of Apple's mobile operating system. When he investigates further, he discovers that the device is an original iPad and that it cannot be updated to a current secure version of the operating system. What would be the best option for handling this device?Retire or replace the device.Isolate the device on a dedicated wireless network.Install a firewall on the tablet.Reinstall the OS.

77 Tonya believes that an attacker was able to eavesdrop on legitimate HTTPS communications between her users and remote web servers by engaging in a DNS poisoning attack. After conducting DNS poisoning, what technique would an attacker likely use to conduct this eavesdropping?Man-in-the-middleBrute-forceTimingMeet-in-the-middle

78 Howard is choosing a cryptographic algorithm for his organization, and he would like to choose an algorithm that supports the creation of digital signatures. Which one of the following algorithms would meet his requirement?RSA3DESAESBlowfish

79 Laura is responsible for securing her company's web-based applications and wants to conduct an educational program for developers on common web application security vulnerabilities. Where can she turn for a concise listing of the most common web application issues?CVENSAOWASPCSA

80 The Bell-LaPadula and Biba models implement state machines in a fashion that uses what specific state machine model?Information flowNoninterferenceCascadingFeedback

81 During a third-party vulnerability scan and security test, Danielle's employer recently discovered that the embedded systems that were installed to manage her company's new buildings have a severe remote access vulnerability. The manufacturer has gone out of business, and there is no patch or update for the devices. What should Danielle recommend that her employer do about the hundreds of devices that are vulnerable?Identify a replacement device model and replace every device.Turn off all of the devices.Move the devices to a secure and isolated network segment.Reverse engineer the devices and build an in-house patch.

82 What type of motion detector senses changes in the electromagnetic fields in monitored areas?InfraredWave patternCapacitancePhotoelectric

83 Mike has been tasked with preventing an outbreak of malware like Mirai, a botnet that targeted IP-based cameras and routers. What type of systems should be protected in his organization?ServersSCADAMobile devicesInternet of Things (IoT) devices

84 Which one of the following statements is correct about the Biba model of access control?It addresses confidentiality and integrity.It addresses integrity and availability.It prevents covert channel attacks.It focuses on protecting objects from integrity threats.

85 In Transport Layer Security, what type of key is used to encrypt the actual content of communications between a web server and a client?Ephemeral session keyClient's public keyServer's public keyServer's private key

86 Beth would like to include technology in a secure area of her data center to protect against unwanted electromagnetic emanations. What technology would assist her with this goal?Heartbeat sensorFaraday cage PiggybackingWPA2

87 In a virtualized computing environment, what component is responsible for enforcing separation between guest machines?Guest operating systemHypervisorKernelProtection manager

88 Rick is an application developer who works primarily in Python. He recently decided to evaluate a new service where he provides his Python code to a vendor who then executes it on their server environment. What type of cloud computing environment is this service?SaaSPaaSIaaSCaaS

89 A component failure in the primary HVAC system leads to a high temperature alarm in the data center that Kim manages. After resolving the issue, what should Kim consider to prevent future issues like this?A closed loop chillerRedundant cooling systemsSwamp coolersRelocating the data center to a colder climate

90 Tommy is planning to implement a power conditioning UPS for a rack of servers in his data center. Which one of the following conditions will the UPS be unable to protect against if it persists for an extended period of time?FaultBlackoutSagNoise

91 Which one of the following humidity values is within the acceptable range for a data center operation?0 percent10 percent25 percent40 percent

92 Kristen's organization suffered a ransomware infection and has lost access to critical business data. She is considering paying the ransom to regain access to her data. Which of the following statements about this payment are correct? (Select all that apply.)Payment of the ransom may be illegal.Payment of the ransom may result in further demands for payments.Payment of the ransom guarantees access to the decryption key.Payment of the ransom may cause a data breach.

93 Alex's employer creates most of their work output as PDF files. Alex is concerned about limiting the audience for the PDF files to those individuals who have paid for them. What technology can he use to most effectively control the access to and distribution of these files?EDMEncryptionDigital signaturesDRM

94 As part of his team's forensic investigation process, Matt signs out drives and other evidence from an evidence storage facility before working with them. What type of documentation is he creating?CriminalChain of custodyCivilCYA

95 Todd believes that a digital certificate used by his organization has been compromised and he wants to add it to the certificate revocation list (CRL). What element of the certificate goes on the CRL?Serial numberPublic keyDigital signaturePrivate key

96 Alison is examining a digital certificate presented to her by her bank's website. Which one of the following requirements is not necessary for her to trust the digital certificate?She knows that the server belongs to the bank.She trusts the certificate authority.She verifies that the certificate is not listed on a CRL.She verifies the digital signature on the certificate.

97 Which one of the following is an example of a covert timing channel when used to exfiltrate information from an organization?Sending an electronic mail messagePosting a file on a peer-to-peer file sharing service Typing with the rhythm of Morse codeWriting data to a shared memory space

98 Which one of the following would be a reasonable application for the use of self-signed digital certificates?Digital commerce websiteBanking applicationInternal scheduling applicationCustomer portal

99 Ron is investigating a security incident that took place at a highly secure government facility. He believes that encryption keys were stolen during the attack and finds evidence that the attackers used dry ice to freeze an encryption component. What type of attack was likely attempted?Side channel attackBrute-force attackTiming attackFault injection attack

100 Match the following numbered security models with the appropriate lettered security descriptions:Security modelsClark-WilsonGraham-DenningBell-LaPadulaBibaDescriptionsThis model blocks lower-classified objects from accessing higher-classified objects, thus ensuring confidentiality.The * property of this model can be summarized as “no write-up.”This model uses security labels to grant access to objects via transformation procedures and a restricted interface model.This model focuses on the secure creation and deletion of subjects and objects using eight primary protection rules or actions.

101 Match each of these following numbered architecture security concepts with the appropriate lettered description:Architectural security conceptsTime of checkCovert channelTime of useMaintenance hooksParameter checkingRace conditionDescriptionsA method used to pass information over a path not normally used for communicationThe exploitation of the reliance of a system's behavior on the sequence of events that occur externallyThe time at which the subject checks whether an object is availableThe time at which a subject can access an objectAn access method known only to the developer of the systemA method that can help prevent buffer overflow attacks