BEST Verified ISC CSSLP Exam Questions (2023) [Q18-Q38]

NO.18 Stella works as a system engineer for BlueWell Inc. She wants to identify the performance thresholds of each build. Which of the following tests will help Stella to achieve her task?

Reliability test

Performance test

Regression test

Functional test

NO.19 Which of the following can be used to accomplish authentication? Each correct answer represents a complete solution. Choose all that apply.

Encryption

Biometrics

Token

Password

NO.20 Which of the following security models dictates that subjects can only access objects through applications?

Biba model

Bell-LaPadula

Clark-Wilson

Biba-Clark model

NO.21 Which of the following DoD policies establishes policies and assigns responsibilities to achieve DoD IA through a defense-in-depth approach that integrates the capabilities of personnel, operations, and technology, and supports the evolution to network-centric warfare?

DoDI 5200.40

DoD 8500.1 Information Assurance (IA)

DoD 8510.1-M DITSCAP

DoD 8500.2 Information Assurance Implementation

NO.22 In which of the following deployment models of cloud is the cloud infrastructure administered by the organizations or a third party? Each correct answer represents a complete solution. Choose two.

Private cloud

Public cloud

Hybrid cloud

Community cloud

NO.23 Which of the following are the levels of public or commercial data classification system? Each correct answer represents a complete solution. Choose all that apply.

Sensitive

Private

Unclassified

Confidential

Secret

Public

NO.24 Samantha works as an Ethical Hacker for we-are-secure Inc. She wants to test the security of the we-are- secure server for DoS attacks. She sends large number of ICMP ECHO packets to the target computer.
Which of the following DoS attacking techniques will she use to accomplish the task?

Smurf dos attack

Land attack

Ping flood attack

Teardrop attack

NO.25 You work as a security engineer for BlueWell Inc. According to you, which of the following DITSCAP/ NIACAP model phases occurs at the initiation of the project, or at the initial C&A effort of a legacy system?

Validation

Definition

Verification

Post Accreditation

NO.26 You work as a security manager for BlueWell Inc. You are going through the NIST SP 800-37 C&A methodology, which is based on four well defined phases. In which of the following phases of NIST SP 800-37 C&A methodology does the security categorization occur?

Security Accreditation

Security Certification

Continuous Monitoring

Initiation

NO.27 Which of the following roles is also known as the accreditor?

Data owner

Chief Risk Officer

Chief Information Officer

Designated Approving Authority

NO.28 You work as a system engineer for BlueWell Inc. You want to verify that the build meets its data requirements, and correctly generates each expected display and report. Which of the following tests will help you to perform the above task?

Performance test

Functional test

Reliability test

Regression test

NO.29 Which of the following elements of the BCP process emphasizes on creating the scope and the additional elements required to define the parameters of the plan?

Business continuity plan development

Plan approval and implementation

Business impact analysis

Scope and plan initiation

NO.30 What NIACAP certification levels are recommended by the certifier? Each correct answer represents a complete solution. Choose all that apply.

Comprehensive Analysis

Maximum Analysis

Detailed Analysis

Minimum Analysis

Basic Security Review

Basic System Review

NO.31 DIACAP applies to the acquisition, operation, and sustainment of any DoD system that collects, stores, transmits, or processes unclassified or classified information since December 1997. What phases are identified by DIACAP? Each correct answer represents a complete solution. Choose all that apply.

System Definition

Validation

Identification

Accreditation

Verification

Re-Accreditation

NO.32 Which of the following governance bodies provides management, operational and technical controls to satisfy security requirements?

Senior Management

Business Unit Manager

Information Security Steering Committee

Chief Information Security Officer

NO.33 Which of the following actions does the Data Loss Prevention (DLP) technology take when an agent detects a policy violation for data of all states? Each correct answer represents a complete solution.
Choose all that apply.

It creates an alert.

It quarantines the file to a secure location.

It reconstructs the session.

It blocks the transmission of content.

NO.34 Which of the following federal agencies has the objective to develop and promote measurement, standards, and technology to enhance productivity, facilitate trade, and improve the quality of life?

National Security Agency (NSA)

National Institute of Standards and Technology (NIST)

United States Congress

Committee on National Security Systems (CNSS)

Explanation/Reference:
Explanation: The National Institute of Standards and Technology (NIST), known between 1901 and 1988 as the National Bureau of Standards (NBS), is a measurement standards laboratory which is a non- regulatory agency of the United States Department of Commerce. The institute’s official mission is to promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve quality of life. Answer D is incorrect.
The Committee on National Security Systems (CNSS) is a United States intergovernmental organization that sets policy for the security of the US security systems. The CNSS holds discussions of policy issues, sets national policy, directions, operational procedures, and guidance for the information systems operated by the U.S. Government, its contractors, or agents that contain classified information, involve intelligence activities, involve cryptographic activities related to national security, etc. Answer A is incorrect.
The National Security Agency/Central Security Service (NSA/CSS) is a crypto-logic intelligence agency of the United States government. It is administered as part of the United States Department of Defense. NSA is responsible for the collection and analysis of foreign communications and foreign signals intelligence, which involves cryptanalysis. NSA is also responsible for protecting U.S. government communications and information systems from similar agencies elsewhere, which involves cryptography. NSA is a key component of the U.S. Intelligence Community, which is headed by the Director of National Intelligence.
The Central Security Service is a co-located agency created to coordinate intelligence activities and co- operation between NSA and U.S. military cryptanalysis agencies. NSA’s work is limited to communications intelligence. It does not perform field or human intelligence activities. Answer C is incorrect. The United States Congress is the bicameral legislature of the federal government of the United States of America. It consists of the Senate and the House of Representatives. The Congress meets in the United States Capitol in Washington, D.C. Both senators and representatives are chosen through direct election. Each of the 435 members of the House of Representatives represents a district and serves a two-year term. House seats are apportioned among the states by population. The 100 Senators serve staggered six-year terms.
Each state has two senators, regardless of population. Every two years, approximately one-third of the Senate is elected at a time. The United States Congress main function is to make laws. The Office of the Law Revision Counsel organizes and publishes the United States Code (USC). It is a consolidation and codification by subject matter of the general and permanent laws of the United States.

NO.35 Which of the following is an open source network intrusion detection system?

NETSH

Macof

Sourcefire

Snort

Explanation:
Snort is an open source network intrusion prevention and detection system that operates as a network sniffer. It logs activities of the network that is matched with the predefined signatures. Signatures can be designed for a wide range of traffic, including Internet Protocol (IP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Internet Control Message Protocol (ICMP). The three main modes in which Snort can be configured are as follows:
Sniffer mode: It reads the packets of the network and displays them in a continuous stream on the console. Packet logger mode: It logs the packets to the disk. Network intrusion detection mode: It is the most complex and configurable configuration, allowing Snort to analyze network traffic for matches against a user-defined rule set.

NO.36 FIPS 199 defines the three levels of potential impact on organizations. Which of the following potential impact levels shows limited adverse effects on organizational operations, organizational assets, or individuals?

Moderate

Low

Medium

High

NO.37 You work as a systems engineer for BlueWell Inc. Which of the following tools will you use to look outside your own organization to examine how others achieve their performance levels, and what processes they use to reach those levels?

Benchmarking

Six Sigma

ISO 9001:2000

SEI-CMM

Explanation/Reference:
Explanation: Benchmarking is the tool used by system assessment process to provide a point of reference by which performance measurements can be reviewed with respect to other organizations. Benchmarking is also recognized as Best Practice Benchmarking or Process Benchmarking. It is a process used in management and mostly useful for strategic management. It is the process of comparing the business processes and performance metrics including cost, cycle time, productivity, or quality to another that is widely considered to be an industry standard benchmark or best practice. It allows organizations to develop plans on how to implement best practice with the aim of increasing some aspect of performance.
Benchmarking might be a one-time event, although it is frequently treated as a continual process in which organizations continually seek out to challenge their practices. It allows organizations to develop plans on how to make improvements or adapt specific best practices, usually with the aim of increasing some aspect of performance. Answer: C is incorrect. The ISO 9001:2000 standard combines the three standards
9001, 9002, and 9003 into one, called 9001. Design and development procedures are required only if a company does in fact engage in the creation of new products. The 2000 version sought to make a radical change in thinking by actually placing the concept of process management front and center (“Process management” was the monitoring and optimizing of a company’s tasks and activities, instead of just inspecting the final product). The ISO 9001:2000 version also demands involvement by upper executives, in order to integrate quality into the business system and avoid delegation of quality functions to junior administrators. Another goal is to improve effectiveness via process performance metrics numerical measurement of the effectiveness of tasks and activities. Expectations of continual process improvement and tracking customer satisfaction were made explicit. Answer: B is incorrect. Six Sigma is a business management strategy, initially implemented by Motorola. As of 2009 it enjoys widespread application in many sectors of industry, although its application is not without controversy. Six Sigma seeks to improve the quality of process outputs by identifying and removing the causes of defects and variability in manufacturing and business processes. It uses a set of quality management methods, including statistical methods, and creates a special infrastructure of people within the organization (“Black Belts”, “Green Belts”, etc.) who are experts in these methods. Each Six Sigma project carried out within an organization follows a defined sequence of steps and has quantified financial targets (cost reduction or profit increase).
The often used Six Sigma symbol is as follows:

Answer D is incorrect. Capability Maturity Model Integration (CMMI) was created by Software Engineering
Institute (SEI). CMMI in software engineering and organizational development is a process improvement approach that provides organizations with the essential elements for effective process improvement. It can be used to guide process improvement across a project, a division, or an entire organization. CMMI can help integrate traditionally separate organizational functions, set process improvement goals and priorities, provide guidance for quality processes, and provide a point of reference for appraising current processes.
CMMI is now the de facto standard for measuring the maturity of any process. Organizations can be assessed against the CMMI model using Standard CMMI Appraisal Method for Process Improvement (SCAMPI).

NO.38 Which of the following security controls works as the totality of protection mechanisms within a computer system, including hardware, firmware, and software, the combination of which is responsible for enforcing a security policy?

Common data security architecture (CDSA)

Application program interface (API)

Trusted computing base (TCB)

Internet Protocol Security (IPSec)

BEST Verified ISC CSSLP Exam Questions (2023) [Q18-Q38]

No Responses

Leave a Reply Cancel reply

Related Certifications

CSSLP Practice Tests

Recent Posts

Recent Comments

Categories