CISSP Exam 2015+

Question 1 of 113

1

Which of the following can be defined as the process of rerunning a portion of the test scenario or test plan to ensure that changes or corrections have not introduced new errors?

Select one of the following:

Unit testing
Parallel testing
Regression testing
Pilot testing

Explanation

Question 2 of 113

1

At which layer of the OSI model do sniffers operate?

Select one of the following:

Layer 2 - Data Link Layer
Layer 1 - Hardware layer
Layer 3 - Networking Layer
Layer 7 - Application layer

Explanation

Question 3 of 113

1

When two or more separate entities (usually persons) operating in concert to protect sensitive functions or information must combine their knowledge to gain access to an asset, this is known as?

Select one of the following:

Segragation of duties
Separation of duties
Need to know
Dual Control

Explanation

Question 4 of 113

1

What is the name for a substitution cipher that shifts the alphabet by 13 places?

Select one of the following:

Transposition cipher
Caesar cipher
Polyalphabetic cipher
ROT13 cipher

Explanation

Question 5 of 113

1

Your organization creates software applications that are sold to the public. Recently, management has become concerned about software piracy. Which organization deals with the prevention of this crime?

Select one of the following:

CIA
DoD
SPA
NCSC

Explanation

Question 6 of 113

1

A potential problem related to the physical installation of the Iris Scanner in regards to the usage of the iris pattern within a biometric system is:

Select one of the following:

Concern that the laser beam may cause eye damage.
The iris pattern changes as a person grows older.
There is a relatively high rate of false accepts.
The optical unit must be positioned so that the sun does not shine into the aperture.

Explanation

Question 7 of 113

1

In Mandatory Access Control, sensitivity labels attached to object contain what information?

Select one of the following:

The item's classification
The item's classification and category set
The item's category
The items's need to know

Explanation

Question 8 of 113

1

Which of the following is true about Kerberos?

Select one of the following:

It utilizes public key cryptography.
It encrypts data after a ticket is granted, but passwords are exchanged in plain text.
It depends upon symmetric ciphers.
It is a second party authentication system.

Explanation

Question 9 of 113

1

Which of the following is needed for System Accountability?

Select one of the following:

Audit mechanisms.
Documented design as laid out in the Common Criteria.
Authorization.
Formal verification of system design.

Explanation

Question 10 of 113

1

What is Kerberos?

Select one of the following:

A three-headed dog from the Egyptian mythology.
A trusted third-party authentication protocol.
A security model.
A remote authentication dial in user server.

Explanation

Question 11 of 113

1

Kerberos depends upon what encryption method?

Select one of the following:

Public Key cryptography.
Secret Key cryptography.
El Gamal cryptography.
Blowfish cryptography.

Explanation

Question 12 of 113

1

A confidential number used as an authentication factor to verify a user's identity is called a:

Select one of the following:

PIN
User ID
Password
Challenge

Explanation

Question 13 of 113

1

Individual accountability does not include which of the following?

Select one of the following:

unique identifiers
policies & procedures
access rules
audit trails

Explanation

Question 14 of 113

1

Which of the following exemplifies proper separation of duties?

Select one of the following:

Operators are not permitted modify the system time.
Programmers are permitted to use the system console.
Console operators are permitted to mount tapes and disks.
Tape operators are permitted to use the system console.

Explanation

Question 15 of 113

1

An access control policy for a bank teller is an example of the implementation of which of the following?

Select one of the following:

Rule-based policy
Identity-based policy
User-based policy
Role-based policy

Explanation

Question 16 of 113

1

Which one of the following authentication mechanisms creates a problem for mobile users?

Select one of the following:

Mechanisms based on IP addresses
Mechanism with reusable passwords
One-time password mechanism.
Challenge response mechanism.

Explanation

Question 17 of 113

1

Organizations should consider which of the following first before allowing external access to their LANs via the Internet?

Select one of the following:

Plan for implementing workstation locking mechanisms.
Plan for protecting the modem pool.
Plan for providing the user with his account usage information.
Plan for considering proper authentication options.

Explanation

Question 18 of 113

1

Kerberos can prevent which one of the following attacks?

Select one of the following:

Tunneling attack.
Playback (replay) attack.
Destructive attack.
Process attack.

Explanation

Question 19 of 113

1

In discretionary access environments, which of the following entities is authorized to grant information access to other people?

Select one of the following:

Manager
Group Leader
Security Manager
Data Owner

Explanation

Question 20 of 113

1

What is the main concern with single sign-on?

Select one of the following:

Maximum unauthorized access would be possible if a password is disclosed.
The security administrator's workload would increase.
The users' password would be too hard to remember.
User access rights would be increased.

Explanation

Question 21 of 113

1

Who developed one of the first mathematical models of a multilevel-security computer system?

Select one of the following:

Diffie and Hellman.
Clark and Wilson.
Bell and LaPadula.
Gasser and Lipner.

Explanation

Question 22 of 113

1

Which of the following attacks could capture network user passwords?

Select one of the following:

Data diddling
Sniffing
IP Spoofing
Smurfing

Explanation

Question 23 of 113

1

Which of the following would constitute the best example of a password to use for access to a system by a network administrator?

Select one of the following:

holiday
Christmas12
Jenny
GyN19Za!

Explanation

Question 24 of 113

1

What physical characteristic does a retinal scan biometric device measure?

Select one of the following:

The amount of light reaching the retina
The amount of light reflected by the retina
The pattern of light receptors at the back of the eye
The pattern of blood vessels at the back of the eye

Explanation

Question 25 of 113

1

The Computer Security Policy Model the Orange Book is based on is which of the following?

Select one of the following:

Bell-LaPadula
Data Encryption Standard
Kerberos
Tempest

Explanation

Question 26 of 113

1

The end result of implementing the principle of least privilege means which of the following?

Select one of the following:

Users would get access to only the info for which they have a need to know
Users can access all systems.
Users get new privileges added when they change positions.
Authorization creep.

Explanation

Question 27 of 113

1

Which of the following is the most reliable authentication method for remote access?

Select one of the following:

Variable callback system
Synchronous token
Fixed callback system
Combination of callback and caller ID

Explanation

Question 28 of 113

1

Which of the following is true of two-factor authentication?

Select one of the following:

It uses the RSA public-key signature based on integers with large prime factors.
It requires two measurements of hand geometry.
It does not use single sign-on technology.
It relies on two independent proofs of identity.

Explanation

Question 29 of 113

1

The primary service provided by Kerberos is which of the following?

Select one of the following:

non-repudiation
confidentiality
authentication
authorization

Explanation

Question 30 of 113

1

There are parallels between the trust models in Kerberos and Public Key Infrastructure (PKI).
When we compare them side by side, Kerberos tickets correspond most closely to which of the following?

Select one of the following:

public keys
private keys
public-key certificates
private-key certificates

Explanation

Question 31 of 113

1

In which of the following security models is the subject's clearance compared to the object's classification such that specific rules can be applied to control how the subject-to-object interactions take place?

Select one of the following:

Bell-LaPadula model
Biba model
Access Matrix model
Take-Grant model

Explanation

Question 32 of 113

1

Which of the following was developed to address some of the weaknesses in Kerberos and uses public key cryptography for the distribution of secret keys and provides additional access control support?

Select one of the following:

SESAME
RADIUS
KryptoKnight
TACACS+

Explanation

Question 33 of 113

1

Single Sign-on (SSO) is characterized by which of the following advantages?

Select one of the following:

Convenience
Convenience and centralized administration
Convenience and centralized data administration
Convenience and centralized network administration

Explanation

Question 34 of 113

1

What is the primary role of smartcards in a PKI?

Select one of the following:

Transparent renewal of user keys
Easy distribution of the certificates between the users
Fast hardware encryption of the raw data
Tamper resistant, mobile storage and application of private keys of the users

Explanation

Question 35 of 113

1

What kind of certificate is used to validate a user identity?

Select one of the following:

Public key certificate
Attribute certificate
Root certificate
Code signing certificate

Explanation

Question 36 of 113

1

The following is not a security characteristic we need to consider while choosing a biometric identification systems:

Select one of the following:

data acquisition process
cost
enrollment process
speed and user interface

Explanation

Question 37 of 113

1

In biometric identification systems, at the beginning, it was soon apparent that truly positive identification could only be based on physical attributes of a person.

This raised the necessity of answering 2 questions:

Select one of the following:

what was the sex of a person and his age
what part of body to be used and how to accomplish identification that is viable
what was the age of a person and his income level
what was the tone of the voice of a person and his habits

Explanation

Question 38 of 113

1

In biometric identification systems, the parts of the body conveniently available for identification are:

Select one of the following:

neck and mouth
hands, face, and eyes
feet and hair
voice and neck

Explanation

Question 39 of 113

1

Controlling access to information systems and associated networks is necessary for the preservation of their:

Select one of the following:

Authenticity, confidentiality and availability
Confidentiality, integrity, and availability.
integrity and availability.
authenticity, confidentiality, integrity and availability.

Explanation

Question 40 of 113

1

To control access by a subject (an active entity such as individual or process) to an object (a passive entity such as a file) involves setting up:

Select one of the following:

Access Rules
Access Matrix
Identification controls
Access terminal

Explanation

Question 41 of 113

1

Rule-Based Access Control (RuBAC) access is determined by rules.
Such rules would fit within what category of access control?

Select one of the following:

Discretionary Access Control (DAC)
Mandatory Access control (MAC)
Non-Discretionary Access Control (NDAC)
Lattice-based Access control

Explanation

Question 42 of 113

1

The type of discretionary access control (DAC) that is based on an individual's identity is also called:

Select one of the following:

Identity-based Access control
Rule-based Access control
Non-Discretionary Access Control
Lattice-based Access control

Explanation

Question 43 of 113

1

Which access control type has a central authority that determine to what objects the subjects have access to and it is based on role or on the organizational security policy?

Select one of the following:

Mandatory Access Control
Discretionary Access Control
Non-Discretionary Access Control
Rule-based Access control

Explanation

Question 44 of 113

1

Which of the following control pairings include: organizational policies and procedures, pre- employment background checks, strict hiring practices, employment agreements, employee termination procedures, vacation scheduling, labeling of sensitive materials, increased supervision, security awareness training, behavior awareness, and sign-up procedures to obtain access to information systems and networks?

Select one of the following:

Preventive/Administrative Pairing
Preventive/Technical Pairing
Preventive/Physical Pairing
Detective/Administrative Pairing

Explanation

Question 45 of 113

1

Technical controls such as encryption and access control can be built into the operating system, be software applications, or can be supplemental hardware/software units.
Such controls, also known as logical controls, represent which pairing?

Select one of the following:

Preventive/Administrative Pairing
Preventive/Technical Pairing
Preventive/Physical Pairing
Detective/Technical Pairing

Explanation

Question 46 of 113

1

What is called the use of technologies such as fingerprint, retina, and iris scans to authenticate the individuals requesting access to resources?

Select one of the following:

Micrometrics
Macrometrics
Biometrics
MicroBiometrics

Explanation

Question 47 of 113

1

What is called the access protection system that limits connections by calling back the number of a previously authorized location?

Select one of the following:

Sendback systems
Callback forward systems
Callback systems
Sendback forward systems

Explanation

Question 48 of 113

1

What are called user interfaces that limit the functions that can be selected by a user?

Select one of the following:

Constrained user interfaces
Limited user interfaces
Mini user interfaces
Unlimited user interfaces

Explanation

Question 49 of 113

1

Controls such as job rotation, the sharing of responsibilities, and reviews of audit records are associated with:

Select one of the following:

Preventive/physical
Detective/technical
Detective/physical
Detective/administrative

Explanation

Question 50 of 113

1

The control measures that are intended to reveal the violations of security policy using software and hardware are associated with:

Select one of the following:

Preventive/physical
Detective/technical
Detective/physical
Detective/administrative

Explanation

Question 51 of 113

1

The controls that usually require a human to evaluate the input from sensors or cameras to determine if a real threat exists are associated with:

Select one of the following:

Preventive/physical
Detective/technical
Detective/physical
Detective/administrative

Explanation

Question 52 of 113

1

External consistency ensures that the data stored in the database is:

Select one of the following:

in-consistent with the real world.
remains consistant when sent from one system to another.
consistent with the logical world.
consistent with the real world.

Explanation

Question 53 of 113

1

A central authority determines what subjects can have access to certain objects based on the organizational security policy is called:

Select one of the following:

Mandatory Access Control
Discretionary Access Control
Non-Discretionary Access Control
Rule-based Access control

Explanation

Question 54 of 113

1

What is called the act of a user professing an identity to a system, usually in the form of a log-on ID?

Select one of the following:

Authentication
Identification
Authorization
Confidentiality

Explanation

Question 55 of 113

1

Which one of the following factors is not one on which Authentication is based?

Select one of the following:

Type 1 Something you know, such as a PIN or password
Type 2 Something you have, such as an ATM card or smart card
Type 3 Something you are (based upon one or more intrinsic physical or behavioral traits), such as a fingerprint or retina scan
Type 4 Something you are, such as a system administrator or security administrator

Explanation

Question 56 of 113

1

A central authority determines what subjects can have access to certain objects based on the organizational security policy is called:

Select one of the following:

Mandatory Access Control
Discretionary Access Control
Non-Discretionary Access Control
Rule-based Access control

Explanation

Question 57 of 113

1

What is called the act of a user professing an identity to a system, usually in the form of a log-on ID?

Select one of the following:

Authentication
Identification
Authorization
Confidentiality

Explanation

Question 58 of 113

1

What is called the verification that the user's claimed identity is valid and is usually implemented through a user password at log-on time?

Select one of the following:

Authentication
Identification
Integrity
Confidentiality

Explanation

Question 59 of 113

1

Which one of the following factors is not one on which Authentication is based?

Select one of the following:

Type 1 Something you know, such as a PIN or password
Type 2 Something you have, such as an ATM card or smart card
Type 3 Something you are (based upon one or more intrinsic physical or behavioral traits), such as a fingerprint or retina scan
Type 4 Something you are, such as a system administrator or security administrator

Explanation

Question 60 of 113

1

The act of requiring two of the three factors to be used in the authentication process refers to:

Select one of the following:

Two-Factor Authentication
One-Factor Authentication
Bi-Factor Authentication
Double Authentication

Explanation

Question 61 of 113

1

Which type of password provides maximum security because a new password is required for each new log-on?

Select one of the following:

One-time or dynamic password
Congnitive password
Static password
Passphrase

Explanation

Question 62 of 113

1

What is called a password that is the same for each log-on session?

Select one of the following:

"one-time password"
"two-time password"
static password
dynamic password

Explanation

Question 63 of 113

1

What is called a sequence of characters that is usually longer than the allotted number for a password?

Select one of the following:

passphrase
cognitive phrase
anticipated phrase
Real phrase

Explanation

Question 64 of 113

1

Which best describes a tool (i.e. keyfob, calculator, memory card or smart card) used to supply dynamic passwords?

Select one of the following:

Tickets
Tokens
Token passing networks
Coupons

Explanation

Question 65 of 113

1

Which of the following would be true about Static password tokens?

Select one of the following:

The owner identity is authenticated by the token
The owner will never be authenticated by the token.
The owner will authenticate himself to the system
The token does not authenticates the token owner but the system

Explanation

Question 66 of 113

1

In Synchronous dynamic password tokens:

Select one of the following:

The token generates a new password value at fixed time intervals (this password could be based on the time of day encrypted with a secret key).
The token generates a new non-unique password value at fixed time intervals (this password could be based on the time of day encrypted with a secret key).
The unique password is not entered into a system or workstation along with an owner's PIN.
The authentication entity in a system or workstation knows an owner's secret key and PIN, and the entity verifies that the entered password is invalid and that it was entered during the invalid time window

Explanation

Question 67 of 113

1

In biometrics, "one-to-many" search against database of stored biometric images is done in:

Select one of the following:

Authentication
Identification
Identities
Identity-based access control

Explanation

Question 68 of 113

1

Which of the following is true of biometrics?

Select one of the following:

It is used for identification in physical controls and it is not used in logical controls
It is used for authentication in physical controls and for identification in logical controls
It is used for identification in physical controls and for authentication in logical controls.
Biometrics has not role in logical controls.

Explanation

Question 69 of 113

1

What is called the percentage of valid subjects that are falsely rejected by a Biometric Authentication system?

Select one of the following:

False Rejection Rate (FRR) or Type I Error
False Acceptance Rate (FAR) or Type II Error
Crossover Error Rate (CER)
True Rejection Rate (TRR) or Type III Error

Explanation

Question 70 of 113

1

What is called the percentage of invalid subjects that are falsely accepted by a Biometric authentication system?

Select one of the following:

False Rejection Rate (FRR) or Type I Error
False Acceptance Rate (FAR) or Type II Error
Crossover Error Rate (CER)
True Acceptance Rate (TAR) or Type III Error

Explanation

Question 71 of 113

1

What is called the percentage at which the False Rejection Rate equals the False Acceptance Rate?

Select one of the following:

False Rejection Rate (FRR) or Type I Error
False Acceptance Rate (FAR) or Type II Error
Crossover Error Rate (CER)
Failure to enroll rate (FTE or FER)

Explanation

Question 72 of 113

1

Considerations of privacy, invasiveness, and psychological and physical comfort when using the system are important elements for which of the following?

Select one of the following:

Accountability of biometrics systems
Acceptability of biometrics systems
Availability of biometrics systems
Adaptability of biometrics systems

Explanation

Question 73 of 113

1

Which of the following offers advantages such as the ability to use stronger passwords, easier password administration, one set of credential, and faster resource access?

Select one of the following:

Smart cards
Single Sign-On (SSO)
Symmetric Ciphers
Public Key Infrastructure (PKI)

Explanation

Question 74 of 113

1

Which of the following describes the major disadvantage of many Single Sign-On (SSO) implementations?

Select one of the following:

Once an individual obtains access to the system through the initial log-on, they have access to all resources within the environment that the account has access to.
The initial logon process is cumbersome to discourage potential intruders.
Once a user obtains access to the system through the initial log-on, they only need to logon to some applications.
Once a user obtains access to the system through the initial log-on, he has to logout from all other systems

Explanation

Question 75 of 113

1

Which of the following is implemented through scripts or smart agents that replays the users multiple log-ins against authentication servers to verify a user's identity which permit access to system services?

Select one of the following:

Single Sign-On
Dynamic Sign-On
Smart cards
Kerberos

Explanation

Question 76 of 113

1

Which of the following is not true of the Kerberos protocol?

Select one of the following:

Only a single login is required per session.
The initial authentication steps are done using public key algorithm
The KDC is aware of all systems in the network and is trusted by all of them
It performs mutual authentication

Explanation

Question 77 of 113

1

The authenticator within Kerberos provides a requested service to the client after validating which of the following?

Select one of the following:

timestamp
client public key
client private key
server public key

Explanation

Question 78 of 113

1

Which of the following is addressed by Kerberos?

Select one of the following:

Confidentiality and Integrity
Authentication and Availability
Validation and Integrity
Auditability and Integrity

Explanation

Question 79 of 113

1

Kerberos is vulnerable to replay in which of the following circumstances?

Select one of the following:

When a private key is compromised within an allotted time window
When a public key is compromised within an allotted time window.
When a ticket is compromised within an allotted time window.
When the KSD is compromised within an allotted time window.

Explanation

Question 80 of 113

1

Like the Kerberos protocol, SESAME is also subject to which of the following?

Select one of the following:

timeslot replay
password guessing
symmetric key guessing
asymmetric key guessing

Explanation

Question 81 of 113

1

RADIUS incorporates which of the following services?

Select one of the following:

Authentication server and PIN codes.
Authentication of clients and static passwords generation.
Authentication of clients and dynamic passwords generation.
Authentication server as well as support for Static and Dynamic passwords.

Explanation

Question 82 of 113

1

Which of the following protects a password from eavesdroppers and supports the encryption of communication?

Select one of the following:

Challenge Handshake Authentication Protocol (CHAP)
Challenge Handshake Identification Protocol (CHIP)
Challenge Handshake Encryption Protocol (CHEP)
Challenge Handshake Substitution Protocol (CHSP)

Explanation

Question 83 of 113

1

Which of the following represents the columns of the table in a relational database?

Select one of the following:

attributes
relation
record retention
records or tuples

Explanation

Question 84 of 113

1

A database view is the results of which of the following operations?

Select one of the following:

Join and Select.
Join, Insert, and Project
Join, Project, and Create.
Join, Project, and Select.

Explanation

Question 85 of 113

1

Which of the following is used to create and modify the structure of your tables and other objects in the database?

Select one of the following:

SQL Data Definition Language (DDL)
SQL Data Manipulation Language (DML)
SQL Data Relational Language (DRL)
SQL Data Identification Language (DIL)

Explanation

Question 86 of 113

1

Which of the following is used to monitor network traffic or to monitor host audit logs in real time to determine violations of system security policy that have taken place?

Select one of the following:

Intrusion Detection System
Compliance Validation System
Intrusion Management System (IMS)
Compliance Monitoring System

Explanation

Question 87 of 113

1

Which of the following monitors network traffic in real time?

Select one of the following:

network-based IDS
host-based IDS
application-based IDS
firewall-based IDS

Explanation

Question 88 of 113

1

A host-based IDS is resident on which of the following?

Select one of the following:

On each of the critical hosts
decentralized hosts
central hosts
bastion hosts

Explanation

Question 89 of 113

1

Which of the following usually provides reliable, real-time information without consuming network or host resources?

Select one of the following:

network-based IDS
host-based IDS
application-based IDS
firewall-based IDS

Explanation

Question 90 of 113

1

The fact that a network-based IDS reviews packets payload and headers enable which of the following?

Select one of the following:

Detection of denial of service
Detection of all viruses
Detection of data corruption
Detection of all password guessing attacks

Explanation

Question 91 of 113

1

Which of the following reviews system and event logs to detect attacks on the host and determine if the attack was successful?

Select one of the following:

host-based IDS
firewall-based IDS
bastion-based IDS
server-based IDS

Explanation

Question 92 of 113

1

What would be considered the biggest drawback of Host-based Intrusion Detection systems
(HIDS)?

Select one of the following:

It can be very invasive to the host operating system
Monitors all processes and activities on the host system only
Virtually eliminates limits associated with encryption
They have an increased level of visibility and control compared to NIDS

Explanation

Question 93 of 113

1

Attributes that characterize an attack are stored for reference using which of the following
Intrusion Detection System (IDS)?

Select one of the following:

signature-based IDS
statistical anomaly-based IDS
event-based IDS
inferent-based IDS

Explanation

Question 94 of 113

1

Which of the following is an issue with signature-based intrusion detection systems?

Select one of the following:

Only previously identified attack signatures are detected.
Signature databases must be augmented with inferential elements.
It runs only on the windows operating system
Hackers can circumvent signature evaluations.

Explanation

Question 95 of 113

1

Which of the following is an IDS that acquires data and defines a "normal" usage profile for the network or host?

Select one of the following:

Statistical Anomaly-Based ID
Signature-Based ID
dynamical anomaly-based ID
inferential anomaly-based ID

Explanation

Question 96 of 113

1

Which of the following is most relevant to determining the maximum effective cost of access control?

Select one of the following:

the value of information that is protected
management's perceptions regarding data importance
budget planning related to base versus incremental spending
the cost to replace lost data

Explanation

Question 97 of 113

1

Which of the following is not a factor related to Access Control?

Select one of the following:

integrity
authenticity
confidentiality
availability

Explanation

Question 98 of 113

1

Which of the following is most appropriate to notify an external user that session monitoring is being conducted?

Select one of the following:

Logon Banners
Wall poster
Employee Handbook
Written agreement

Explanation

Question 99 of 113

1

Which of the following pairings uses technology to enforce access control policies?

Select one of the following:

Preventive/Administrative
Preventive/Technical
Preventive/Physical
Detective/Administrative

Explanation

Question 100 of 113

1

In the course of responding to and handling an incident, you work on determining the root cause of the incident. In which step are you in?

Select one of the following:

Recovery
Containment
Triage
Analysis and tracking

Explanation

Question 101 of 113

1

Access control is the collection of mechanisms that permits managers of a system to exercise a directing or restraining influence over the behavior, use, and content of a system.
It does not permit management to:

Select one of the following:

specify what users can do
specify which resources they can access
specify how to restrain hackers
specify what operations they can perform on a system

Explanation

Question 102 of 113

1

Access Control techniques do not include which of the following choices?

Select one of the following:

Relevant Access Controls
Discretionary Access Control
Mandatory Access Control
Lattice Based Access Control

Explanation

Question 103 of 113

1

Which of the following statements relating to the Bell-LaPadula security model is false (assuming the Strong Star property is not being used)?

Select one of the following:

A subject is not allowed to read up
The *- property restriction can be escaped by temporarily downgrading a high level subject.
A subject is not allowed to read down
It is restricted to confidentiality

Explanation

Question 104 of 113

1

When a biometric system is used, which error type deals with the possibility of granting access to impostors who should be rejected?

Select one of the following:

Type I error
Type II error
Type III error
Crossover error

Explanation

Question 105 of 113

1

Which of the following is the FIRST step in protecting data's confidentiality?

Select one of the following:

Install a firewall
Implement encryption
Identify which information is sensitive
Review all user access rights

Explanation

Question 106 of 113

1

Which of the following best ensures accountability of users for the actions taken within a system or domain?

Select one of the following:

Identification
Authentication
Authorization
Credentials

Explanation

Question 107 of 113

1

Which of the following statements pertaining to biometrics is false?

Select one of the following:

User can be authenticated based on behavior.
User can be authenticated based on unique physical attributes.
User can be authenticated by what he knows.
A biometric system's accuracy is determined by its crossover error rate (CER).

Explanation

Question 108 of 113

1

Which of the following biometric devices offers the LOWEST CER?

Select one of the following:

Keystroke dynamics
Voice verification
Iris scan
Fingerprint

Explanation

Question 109 of 113

1

Which of the following is the weakest authentication mechanism?

Select one of the following:

Passphrases
Passwords
One-time passwords
Token devices

Explanation

Question 110 of 113

1

Which of the following statements pertaining to access control is false?

Select one of the following:

Users should only access data on a need-to-know basis.
If access is not explicitly denied, it should be implicitly allowed.
Access rights should be granted based on the level of trust a company has on a subject.
Roles can be an efficient way to assign rights to a type of user who performs certain tasks.

Explanation

Question 111 of 113

1

Which of the following is not part of the Kerberos authentication protocol?

Select one of the following:

Symmetric key cryptography
Authentication service (AS)
Principals
Public Key

Explanation

Question 112 of 113

1

	Created by Alexandre Pinheiro over 8 years ago

	Copied by Luiz Felippe De Santis Barbosa almost 8 years ago

CISSP Exam Practice Questions

CISSP Exam 2015+

CISSP Exam 2015+

Question 1 of 113

Which of the following can be defined as the process of rerunning a portion of the test scenario or test plan to ensure that changes or corrections have not introduced new errors?

Select one of the following:

Explanation

Question 2 of 113

At which layer of the OSI model do sniffers operate?

Select one of the following:

Explanation

Question 3 of 113

When two or more separate entities (usually persons) operating in concert to protect sensitive functions or information must combine their knowledge to gain access to an asset, this is known as?

Select one of the following:

Explanation

Question 4 of 113

What is the name for a substitution cipher that shifts the alphabet by 13 places?

Select one of the following:

Explanation

Question 5 of 113

Your organization creates software applications that are sold to the public. Recently, management has become concerned about software piracy. Which organization deals with the prevention of this crime?

Select one of the following:

Explanation

Question 6 of 113

A potential problem related to the physical installation of the Iris Scanner in regards to the usage of the iris pattern within a biometric system is:

Select one of the following:

Explanation

Question 7 of 113

In Mandatory Access Control, sensitivity labels attached to object contain what information?

Select one of the following:

Explanation

Question 8 of 113

Which of the following is true about Kerberos?

Select one of the following:

Explanation

Question 9 of 113

Which of the following is needed for System Accountability?

Select one of the following:

Explanation

Question 10 of 113

What is Kerberos?

Select one of the following:

Explanation

Question 11 of 113

Kerberos depends upon what encryption method?

Select one of the following:

Explanation

Question 12 of 113

A confidential number used as an authentication factor to verify a user's identity is called a:

Select one of the following:

Explanation

Question 13 of 113

Individual accountability does not include which of the following?

Select one of the following:

Explanation

Question 14 of 113

Which of the following exemplifies proper separation of duties?

Select one of the following:

Explanation

Question 15 of 113

An access control policy for a bank teller is an example of the implementation of which of the following?

Select one of the following:

Explanation

Question 16 of 113

Which one of the following authentication mechanisms creates a problem for mobile users?

Select one of the following:

Explanation

Question 17 of 113

Organizations should consider which of the following first before allowing external access to their LANs via the Internet?

Select one of the following:

Explanation

Question 18 of 113

Kerberos can prevent which one of the following attacks?

Select one of the following:

Explanation

Question 19 of 113

In discretionary access environments, which of the following entities is authorized to grant information access to other people?

Select one of the following:

Explanation

Question 20 of 113

There are parallels between the trust models in Kerberos and Public Key Infrastructure (PKI).
When we compare them side by side, Kerberos tickets correspond most closely to which of the following?

In biometric identification systems, at the beginning, it was soon apparent that truly positive identification could only be based on physical attributes of a person.

This raised the necessity of answering 2 questions: