Exam (elaborations)
CISSP PRACTICE TEST 1 250 QUESTIONS AND ANSWERS WITH SOLUTIONS 2024
- Course
- Institution
CISSP PRACTICE TEST 1 250 QUESTIONS AND ANSWERS WITH SOLUTIONS 2024
[Show more]
Content preview
CISSP PRACTICE TEST 1 250QUESTIONS AND ANSWERS WITH
SOLUTIONS 2024
*baseline - ANSWER NIST SP 800-53 discusses security control baselines as a list of security controls. CIS
releases security baselines, and a baseline is a useful part of a threat management strategy and may
contain a list of acceptable configuration items.
*Content Distribution Network (CDN) - ANSWER is designed to provide reliable, low-latency,
geographically distributed content distribution. In this scenario, a CDN is an ideal solution. A P2P CDN
like BitTorrent isn't a typical choice for a commercial entity, whereas redundant servers or a hot site can
provide high availability but won't provide the remaining requirements.
Blocking read commands sent to the device - ANSWER A forensic disk controller performs four functions.
One of those, write blocking, intercepts write commands sent to the device and prevents them from
modifying data on the device. The other three functions include returning data requested by a read
operation, returning access-significant information from the device, and reporting errors from the device
back to the forensic host. The controller should not prevent read commands from being sent to the
device because those commands may return crucial information.
RAID 1 - ANSWER Disk mirroring, requires two physical disks that will contain copies of the same data.
TGS, or Ticket-Granting Service (which is usually on the same server as the KDC) - ANSWER receives a
TGT from the client. It validates the TGT and the user's rights to access the service they are requesting to
use. The TGS then issues a ticket and session keys to the client. The AS serves as the authentication
server, which forwards the username to the KDC.
*Asynchronous - ANSWER X communications rely on a a built-in stop and start flag or bit. This makes
asynchronous communications less efficient than synchronous communications, but better suited to
some types of communication.
*Wave pattern - ANSWER X motion detectors transmit ultrasonic or microwave signals into the monitor
area, watching for changes in the returned signals bouncing off objects.
,A stateful packet inspection firewall - ANSWER X, also known as dynamic packet filtering firewalls, track
the state of a conversation, and can allow a response from a remote system based on an internal system
being allowed to start the communication. Static packet filtering and circuit level gateways only filter
based on source, destination, and ports, whereas application-level gateway firewalls proxy traffic for
specific applications.
A captive portal - ANSWER X can require those who want to connect to and use Wi-Fi to provide an email
address to connect. This allows Ben to provide easy-to-use wireless while meeting his business purposes.
WPA2 PSK is the preshared key mode of WPA and won't provide information about users who are given a
key. Sharing a password doesn't allow for data gathering either. Port security is designed to protect wired
network ports based on MAC addresses.
*Set up a separate SSID using WPA2. - ANSWER Many modern wireless routers can provide multiple
SSIDs. Ben can create a private, secure network for his business operations, but he will need to make
sure that the customer and business networks are firewalled or otherwise logically separated from each
other. Running WPA2 on the same SSID isn't possible without creating another wireless network and
would cause confusion for customers (SSIDs aren't required to be unique). Running a network in
Enterprise mode isn't used for open networks, and WEP is outdated and incredibly vulnerable.
Open networks are unencrypted, making traffic easily sniffable. - ANSWER Unencrypted open networks
broadcast traffic in the clear. This means that unencrypted sessions to websites can be easily captured
with a packet sniffer. Some tools like FireSheep have been specifically designed to capture sessions from
popular websites. Fortunately, many now use TLS by default, but other sites still send user session
information in the clear. Shared passwords are not the cause of the vulnerability, ARP spoofing isn't an
issue with wireless networks, and a Trojan is designed to look like safe software, not to compromise a
router.
*AES - ANSWER The DES modes of operation are Electronic Codebook (ECB), Cipher Block Chaining
(CBC), Cipher Feedback (CFB), Output Feedback (OFB), and Counter (CTR). The Advanced Encryption
Standard (AES) is a separate encryption algorithm.
Clipping - ANSWER X is an analysis technique that only reports alerts after they exceed a set threshold. It
is a specific form of sampling, which is a more general term that describes any attempt to excerpt
records for review. Thresholding is not a commonly used term. Administrators may choose to configure
automatic or manual account lockout after failed login attempts but that is not described in the scenario.
RADIUS - ANSWER X is a common AAA technology used to provide services for dial-up, wireless
networks, network devices, and a range of other systems. OAuth is an authentication protocol used to
,allow applications to act on a user's behalf without sharing the password, and is used for many web
applications. While both XTACACS and TACACS+ provide the functionality Sally is looking for, both are
Cisco proprietary protocols.
Inference - ANSWER In an X attack, the attacker uses several pieces of generic nonsensitive information
to determine a specific sensitive value.
*Take rule - ANSWER The X allows a subject to take the rights belonging to another object. If Alice has
take rights on Bob, she can give herself the same permissions that Bob already possesses.
A brute-force attack - ANSWER X attacks try every possible password. In this attack, the password is
changing by one letter at each attempt, which indicates that it is a brute-force attack. A dictionary attack
would use dictionary words for the attack, whereas a man-in-the-middle or pass-the-hash attack would
most likely not be visible in an authentication log except as a successful login.
*Isolation - ANSWER X requires that transactions operate separately from each other. Atomicity ensures
that if any part of a database transaction fails, the entire transaction must be rolled back as if it never
occurred. Consistency ensures that all transactions are consistent with the logical rules of the database,
such as having a primary key. Durability requires that once a transaction is committed to the database it
must be preserved.
*Worm - ANSWER X have built-in propagation mechanisms that do not require user interaction, such as
scanning for systems containing known vulnerabilities and then exploiting those vulnerabilities to gain
access. Viruses and Trojan horses typically require user interaction to spread. Logic bombs do not spread
from system to system but lie in wait until certain conditions are met, triggering the delivery of their
payload.
*Teardrop - ANSWER In a X attack, the attacker fragments traffic in such a way that the system is unable
to reassemble them. Modern systems are not vulnerable to this attack if they run current operating
systems, but the concept of this attack illustrates the danger of relying upon users following protocol
specifications instead of performing proper exception handling.
SYN, SYN/ACK, ACK - ANSWER The TCP three-way handshake consists of initial contact via a SYN, or
synchronize flagged packet, which receives a response with a SYN/ACK, or synchronize and acknowledge
flagged packet, which is acknowledged by the original sender with an ACK, or acknowledge packet. RST is
used in TCP to reset a connection, PSH is used to send data immediately, and FIN is used to end a
connection.
, *Assuming control of a nonregistered BYOD mobile device - ANSWER MDM products do not have the
capability of assuming control of a device not currently managed by the organization. This would be
equivalent to hacking into a device owned by someone else and might constitute a crime.
Identity as a Service - ANSWER X provides an identity platform as a third-party service. This can provide
benefits, including integration with cloud services and removing overhead for maintenance of traditional
on-premise identity systems, but can also create risk due to third-party control of identity services and
reliance on an offsite identity infrastructure.
*Advance and protect the profession - ANSWER Gina's actions harm the CISSP certification and
information security community by undermining the integrity of the examination process. While Gina
also is acting dishonestly, the harm to the profession is more of a direct violation of the code of ethics
ALE - ANSWER The annualized loss expectancy is the amount of damage that the organization expects to
occur each year as the result of a given risk.
Whitelisting - ANSWER The X approach to application control allows users to install only those software
packages specifically approved by administrators.. This would be an appropriate approach in a scenario
where application installation needs to be tightly controlled.
Denial of service - ANSWER This is a clear example of a X attack—denying legitimate users authorized
access to the system through the use of overwhelming traffic. It goes beyond a reconnaissance attack
because the attacker is affecting the system, but it is not a compromise because the attacker did not
attempt to gain access to the system. There is no reason to believe that a malicious insider was involved.
Company ID - ANSWER The X is likely unique for each row in the table, making it the best choice for a
primary key. There may be multiple companies that share the same name or ZIP code. Similarly, a single
sales representative likely serves more than one company, making those fields unsuitable for use as a
unique identifier.
PII Personally Identifiable Information - ANSWER X includes data that can be used to distinguish or trace
that person's identity, and also includes information like their medical, educational, financial, and
employment information. PHI is personal health information, EDI is electronic data interchange, and
proprietary data is used to maintain an organization's competitive advantage.
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller Performance. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $16.49. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
76799 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now