(ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests. Mike Chapple

Чтение книги онлайн.

      86 You discover that a user on your network has been using the Wireshark tool, as shown here. Further investigation revealed that he was using it for illicit purposes. What pillar of information security has most likely been violated?IntegrityDenialAvailabilityConfidentiality

      87 Alan is performing threat modeling and decides that it would be useful to decompose the system into the core elements shown here. What tool is he using?Vulnerability assessmentFuzzingReduction analysisData modeling

      88 Craig is selecting the site for a new data center and must choose a location somewhere within the United States. He obtained the earthquake risk map shown here from the United States Geological Survey. Which of the following would be the safest location to build his facility if he were primarily concerned with earthquake risk?New YorkNorth CarolinaIndianaFlorida

      89 Which type of business impact assessment tool is most appropriate when attempting to evaluate the impact of a failure on customer confidence?QuantitativeQualitativeAnnualized loss expectancyReduction

      90 Ryan is a security risk analyst for an insurance company. He is currently examining a scenario in which a malicious hacker might use a SQL injection attack to deface a web server due to a missing patch in the company's web application. In this scenario, what is the threat?Unpatched web applicationWeb defacement Malicious hackerOperating systemFor questions 91–93, please refer to the following scenario:Henry is the risk manager for Atwood Landing, a resort community in the midwestern United States. The resort's main data center is located in northern Indiana in an area that is prone to tornados. Henry recently undertook a replacement cost analysis and determined that rebuilding and reconfiguring the data center would cost $10 million.Henry consulted with tornado experts, data center specialists, and structural engineers. Together, they determined that a typical tornado would cause approximately $5 million of damage to the facility. The meteorologists determined that Atwood's facility lies in an area where they are likely to experience a tornado once every 200 years.

      91 Based upon the information in this scenario, what is the exposure factor for the effect of a tornado on Atwood Landing's data center?10 percent25 percent50 percent75 percent

      92 Based upon the information in this scenario, what is the annualized rate of occurrence for a tornado at Atwood Landing's data center?0.00250.0050.010.015

      93 Based upon the information in this scenario, what is the annualized loss expectancy for a tornado at Atwood Landing's data center?$25,000$50,000$250,000$500,000

      94 John is analyzing an attack against his company in which the attacker found comments embedded in HTML code that provided the clues needed to exploit a software vulnerability. Using the STRIDE model, what type of attack did he uncover?SpoofingRepudiationInformation disclosureElevation of privilege

      95 Chris is worried that the laptops that his organization has recently acquired were modified by a third party to include keyloggers before they were delivered. Where should he focus his efforts to prevent this?His supply chainHis vendor contractsHis post-purchase build processThe original equipment manufacturer (OEM)

      96 In her role as a developer for an online bank, Lisa is required to submit her code for testing and review. After it passes through this process and it is approved, another employee moves the code to the production environment. What security management does this process describe?Regression testingCode reviewChange managementFuzz testing

      97 After completing the first year of his security awareness program, Charles reviews the data about how many staff completed training compared to how many were assigned the training to determine whether he hit the 95 percent completion rate he was aiming for. What is this type of measure called?A KPIA metricAn awareness controlA return on investment rate

      98 Which of the following is not typically included in a prehire screening process?A drug testA background checkSocial media reviewFitness evaluation

      99 Which of the following would normally be considered a supply chain risk? (Select all that apply.)Adversary tampering with hardware prior while being shipped to the end customerAdversary hacking into a web server run by the organization in an IaaS environmentAdversary using social engineering to compromise an employee of a SaaS vendor to gain access to customer accountsAdversary conducting a denial-of-service attack using a botnet

      100 Match the following numbered laws or industry standards to their lettered description:Laws and industry standardsGLBAPCI DSSHIPAASOXDescriptionsA U.S. law that requires covered financial institutions to provide their customers with a privacy notice on a yearly basisA U.S. law that requires internal controls assessments, including IT transaction flows for publicly traded companiesAn industry standard that covers organizations that handle credit cardsA U.S. law that provides data privacy and security requirements for medical information