CISSP OPT 3rd ED Sybex -- Wrong Only Flashcards
Francine is a security specialist for an online service provider in the United States. She recently received a claim from a copyright holder that a user is storing information on her service that violates the third party’s copyright. What law governs the actions that Francine must take?
A. Copyright Act
B. Lanham Act
C. Digital Millennium Copyright Act
D. Gramm Leach Bliley Act
C. Digital Millennium Copyright Act
The Digital Millennium Copyright Act (DMCA) sets forth the requirements for online service providers when handling copyright complaints received from third parties. The Copyright Act creates the mechanics for issuing and enforcing copyrights but does not cover the actions of online service providers. The Lanham Act regulates the issuance of trademarks to protect intellectual property. The Gramm-Leach-Bliley Act regulates the handling of personal financial information.
Question 6 tb787631.CISSPPT3E.c01.006
Which one of the following elements of information is not considered personally identifiable information that would trigger most United States (U.S.) state data breach laws?
A. Student identification number
B. Social Security number
C. Driver’s license number
D. Credit card number
A. Student identification number
Most state data breach notification laws are modeled after California’s data breach notification law, which covers Social Security number, driver’s license number, state identification card number, credit/debit card numbers, and bank account numbers (in conjunction with a PIN or password). California’s breach notification law also protects some items not commonly found in other state laws, including medical records and health insurance information. These laws are separate and distinct from privacy laws, such as the California Consumer Privacy Act (CCPA), which regulates the handling of personal information more broadly.
Question 7 tb787631.CISSPPT3E.c01.007
Renee is speaking to her board of directors about their responsibilities to review cybersecurity controls. What rule requires that senior executives take personal responsibility for information security matters?
A. Due diligence rule
B. Personal liability rule
C. Prudent man rule
D. Due process rule
C. Prudent man rule
The prudent man rule requires that senior executives take personal responsibility for ensuring the due care that ordinary, prudent individuals would exercise in the same situation. The rule originally applied to financial matters, but the Federal Sentencing Guidelines applied them to information security matters in the United States in 1991.
Question 9 tb787631.CISSPPT3E.c01.009
Wanda is working with one of her organization’s European Union business partners to facilitate the exchange of customer information. Wanda’s organization is located in the United States. What would be the best method for Wanda to use to ensure GDPR compliance?
A. Binding corporate rules
B. Privacy Shield
C. Standard contractual clauses
D. Safe harbor
C. Standard contractual clauses
The European Union provides standard contractual clauses that may be used to facilitate data transfer. That would be the best choice in a case where two different companies are sharing data. If the data were being shared internally within a company, binding corporate rules would also be an option. The EU/U.S. Privacy Shield was a safe harbor agreement that would previously have allowed the transfer but is no longer valid.
Question 10 tb787631.CISSPPT3E.c01.010
Yolanda is the chief privacy officer for a financial institution and is researching privacy requirements related to customer checking accounts. Which one of the following laws is most likely to apply to this situation?
A. GLBA
B. SOX
C. HIPAA
D. FERPA
A. GLBA
The Gramm-Leach-Bliley Act (GLBA) contains provisions regulating the privacy of customer financial information. It applies specifically to financial institutions. The Sarbanes Oxley (SOX) Act regulates the financial reporting activities of publicly traded companies. The Health Insurance Portability and Accountability Act (HIPAA) regulates the handling of protected health information (PHI). The Family Educational Rights and Privacy Act (FERPA) regulates the handling of student educational records.
Question 15 tb787631.CISSPPT3E.c01.015
You are completing a review of the controls used to protect a media storage facility in your organization and would like to properly categorize each control that is currently in place. Which of the following control categories accurately describe a fence around a facility? (Select all that apply.)
A. Physical
B. Detective
C. Deterrent
D. Preventive
A. Physical
C. Deterrent
D. Preventive
Question 17 tb787631.CISSPPT3E.c01.017
Vincent believes that a former employee took trade secret information from his firm and brought it with him to a competitor. He wants to pursue legal action. Under what law could he pursue charges?
A. Copyright law
B. Lanham Act
C. Glass-Steagall Act
D. Economic Espionage Act
D. Economic Espionage Act
The Economic Espionage Act imposes fines and jail sentences on anyone found guilty of stealing trade secrets from a U.S. corporation. It gives true teeth to the intellectual property rights of trade secret owners. Copyright law does not apply in this situation because there is no indication that the information was copyrighted. The Lanham Act applies to trademark protection cases. The Glass-Steagall Act was a banking reform act that is not relevant in this situation.
Question 19 tb787631.CISSPPT3E.c01.019
Brenda’s organization recently completed the acquisition of a competitor firm. Which one of the following tasks would be LEAST likely to be part of the organizational processes addressed during the acquisition?
A. Consolidation of security functions
B. Integration of security tools
C. Protection of intellectual property
D. Documentation of security policies
C. Protection of intellectual property
The protection of intellectual property is a greater concern during a divestiture, where a subsidiary is being spun off into a separate organization, than an acquisition, where one firm has purchased another. Acquisition concerns include consolidating security functions and policies as well as integrating security tools.
Question 22 tb787631.CISSPPT3E.c01.022
Which one of the following actions might be taken as part of a business continuity plan?
A. Restoring from backup tapes
B. Implementing RAID
C. Relocating to a cold site
D. Restarting business operations
B. Implementing RAID
RAID technology provides fault tolerance for hard drive failures and is an example of a business continuity action. Restoring from backup tapes, relocating to a cold site, and restarting business operations are all disaster recovery actions.
Question 25 tb787631.CISSPPT3E.c01.025
Laura has been asked to perform an SCA. What type of organization is she most likely in?
A. Higher education
B. Banking
C. Government
D. Healthcare
C. Government
A security controls assessment (SCA) most often refers to a formal U.S. government process for assessing security controls and is often paired with a Security Test and Evaluation (ST&E) process. This means that Laura is probably part of a government organization or contractor.
Question 32 tb787631.CISSPPT3E.c01.032
Gina is working to protect a logo that her company will use for a new product they are launching. She has questions about the intellectual property protection process for this logo. What U.S. government agency would be best able to answer her questions?
A. USPTO
B. Library of Congress
C. NSA
D. NIST
A. USPTO
First, you must realize that a trademark is the correct intellectual property protection mechanism for a logo. Therefore, Gina should contact the United States Patent and Trademark Office (USPTO), which bears responsibility for the registration of trademarks. The Library of Congress administers the copyright program. The National Security Agency (NSA) and the National Institute for Standards and Technology (NIST) play no role in intellectual property protection.
Question 38 tb787631.CISSPPT3E.c01.038
Florian receives a flyer from a U.S. federal government agency announcing that a new administrative law will affect his business operations. Where should he go to find the text of the law?
A. United States Code
B. Supreme Court rulings
C. Code of Federal Regulations
D. Compendium of Laws
C. Code of Federal Regulations
The Code of Federal Regulations (CFR) contains the text of all administrative laws promulgated by federal agencies. The United States Code contains criminal and civil law. Supreme Court rulings contain interpretations of law and are not laws themselves. The Compendium of Laws does not exist.
Question 40 tb787631.CISSPPT3E.c01.040
Which one of the following individuals would be the most effective organizational owner for an information security program?
A. CISSP-certified analyst
B. Chief information officer (CIO)
C. Manager of network security
D. President and CEO
B. Chief information officer (CIO)
The owner of information security programs may be different from the individuals responsible for implementing the controls. This person should be as senior an individual as possible who is able to focus on the management of the security program. The president and CEO would not be an appropriate choice because an executive at this level is unlikely to have the time necessary to focus on security. Of the remaining choices, the CIO is the most senior position who would be the strongest advocate at the executive level.
Question 43 tb787631.CISSPPT3E.c01.043
Gary is analyzing a security incident and, during his investigation, encounters a user who denies having performed an action that Gary believes he did perform. What type of threat has taken place under the STRIDE model?
A. Repudiation
B. Information disclosure
C. Tampering
D. Elevation of privilege
A. Repudiation
Repudiation threats allow an attacker to deny having performed an action or activity without the other party being able to prove differently. There is no evidence that the attacker engaged in information disclosure, tampering, or elevation of privilege.
Question 1 tb787631.CISSPPT3E.c03.016
Please refer to the following scenario:
Alice and Bob would like to use an asymmetric cryptosystem to communicate with each other. They are located in different parts of the country but have exchanged encryption keys by using digital certificates signed by a mutually trusted certificate authority.
If Alice wants to send Bob a message that is encrypted for confidentiality, what key does she use to encrypt the message?
A. Alice’s public key
B. Alice’s private key
C. Bob’s public key
D. Bob’s private key
C. Bob’s public key
In an asymmetric cryptosystem, the sender of a message encrypts the message using the recipient’s public key. The recipient may then decrypt that message using their own private key, which only they should possess.
Question 2 tb787631.CISSPPT3E.c03.023
Susan would like to configure IPsec in a manner that provides confidentiality for the content of packets. What component of IPsec provides this capability?
A. AH
B. ESP
C. IKE
D. ISAKMP
B. ESP
The Encapsulating Security Payload (ESP) protocol provides confidentiality and integrity for packet contents. It encrypts packet payloads and provides limited authentication and protection against replay attacks.
tb787631.CISSPPT3E.c03.099
Ron is investigating a security incident that took place at a highly secure government facility. He believes that encryption keys were stolen during the attack and finds evidence that the attackers used dry ice to freeze an encryption component. What type of attack was likely attempted?
A. Side channel attack
B. Brute-force attack
C. Timing attack
D. Fault injection attack
D. Fault injection attack
In a fault injection attack, the attacker attempts to compromise the integrity of a cryptographic device by causing some type of external fault. For example, they might use high-voltage electricity, high or low temperature, or other factors to cause a malfunction that undermines the security of the device. Side-channel attacks seek to use information about system activity and retrieve information that is actively being encrypted. Brute-force attacks attempt every possible valid combination for a key or password. In a timing attack, the attacker measures precisely how long cryptographic operations take to complete, gaining information about the cryptographic process that may be used to undermine its security.
tb787631.CISSPPT3E.c03.025
Joanna wants to review the status of the industrial control systems her organization uses for building control. What type of systems should she inquire about access to?
A. SCADA
B. DSS
C. BAS
D. ICS-CSS
A. SCADA
Supervisory Control and Data Acquisition systems, or SCADA systems, provide a graphical interface to monitor industrial control systems (ICS). Joanna should ask about access to her organization’s SCADA systems.
Question 5 tb787631.CISSPPT3E.c03.062
A hacker recently violated the integrity of data in James’s company by modifying a file using a precise timing attack. The attacker waited until James verified the integrity of a file’s contents using a hash value and then modified the file between the time that James verified the integrity and read the contents of the file. What type of attack took place?
A. Social engineering
B. TOCTOU
C. Data diddling
D. Parameter checking
B. TOCTOU
In a time of check to time of use (TOCTOU) attack, the attacker exploits the difference in time between when a security control is verified and the data protected by the control is actually used.
Question 6 tb787631.CISSPPT3E.c03.078
Howard is choosing a cryptographic algorithm for his organization, and he would like to choose an algorithm that supports the creation of digital signatures. Which one of the following algorithms would meet his requirement?
A. RSA
B. 3DES
C. AES
D. Blowfish
A. RSA
Digital signatures are possible only when using an asymmetric encryption algorithm. Of the algorithms listed, only RSA is asymmetric and supports digital signature capabilities.
Question 7 tb787631.CISSPPT3E.c03.030
Colin is the chief privacy officer for a non-profit organization and is assisting with the team’s transition to a Privacy by Design approach. Under this approach, which is not one of the Privacy by Design principles that the team should embrace?
A. Proactive, not reactive
B. Privacy as the default setting
C. End-to-end security
D. Defense in depth
D. Defense in depth
While defense in depth is a strong security principle, it is not a component of Privacy by Design. The following are the seven principles of the Privacy by Design model:
Proactive, not reactive; preventive, not remedial
Privacy as the default setting
Privacy embedded into design
Full functionality—positive-sum, not zero-sum
End-to-end security—full lifecycle protection
Visibility and transparency—keep it open
Respect for user privacy—keep it user-centric
Gary intercepts a communication between two individuals and suspects that they are exchanging secret messages. The content of the communication appears to be the image captured. What type of technique may the individuals use to hide messages inside this image?
A. Visual cryptography
B. Steganography
C. Cryptographic hashing
D. Transport layer security
B. Steganography
Steganography is the art of using cryptographic techniques to embed secret messages within other content. Some steganographic algorithms work by making alterations to the least significant bits of the many bits that make up image files.
Question 9 tb787631.CISSPPT3E.c03.031
What cryptographic principle stands behind the idea that cryptographic algorithms should be open to public inspection?
A. Security through obscurity
B. Kerckhoffs’ principle
C. Defense in depth
D. Heisenburg principle
B. Kerckhoffs’ principle
Kerckhoffs’ principle says that a cryptographic system should be secure even if everything about the system, except the key, is public knowledge.
Question 10 tb787631.CISSPPT3E.c03.071
Alan intercepts an encrypted message and wants to determine what type of algorithm was used to create the message. He first performs a frequency analysis and notes that the frequency of letters in the message closely matches the distribution of letters in the English language. What type of cipher was most likely used to create this message?
A. Substitution cipher
B. AES
C. Transposition cipher
D. 3DES
C. Transposition cipher
This message was most likely encrypted with a transposition cipher. The use of a substitution cipher, a category that includes AES and 3DES, would change the frequency distribution so that it did not mirror that of the English language. This type of attack, where the attacker only has access to an encrypted message, is also known as a ciphertext-only attack.
Question 11 tb787631.CISSPPT3E.c03.060
Robert is investigating a security breach and discovers the Mimikatz tool installed on a system in his environment. What type of attack has likely taken place?
A. Password cracking
B. Pass the hash
C. MAC spoofing
D. ARP poisoning
B. Pass the hash
The use of the Mimikatz tool is indicative of an attempt to capture user password hashes for use in a pass-the-hash attack against Microsoft Active Directory accounts.
Question 12 tb787631.CISSPPT3E.c03.049
During a system audit, Casey notices that the private key for her organization’s web server has been stored in a public Amazon S3 storage bucket for more than a year. Which one of the following actions should she take first?
A. Remove the key from the bucket.
B. Notify all customers that their data may have been exposed.
C. Request a new certificate using a new key.
D. Nothing, because the private key should be accessible for validation.
C. Request a new certificate using a new key.
The first thing Casey should do is notify her management, but after that, replacing the certificate and using proper key management practices with the new certificate’s key should be at the top of her list.
Question 13 tb787631.CISSPPT3E.c03.012
In the figure shown here, Sally is blocked from reading the file due to the Biba integrity model. Sally has a Secret security clearance, and the file has a Confidential classification. What principle of the Biba model is being enforced?
A data flow diagram starts with a circle on the left, which represents an entity, Sally. A rounded rectangle is on the right, which represents another entity, Data File. An arrow labeled, Read Request, points from the circle to the rounded rectangle. A cross inscribed in a circle is on the arrow.
A. Simple Security Property
B. Simple Integrity Property
C. *-Security Property
D. *-Integrity Property
B. Simple Integrity Property
The Simple Integrity Property states that an individual may not read a file classified at a lower security level than the individual’s security clearance.
Question 14 tb787631.CISSPPT3E.c03.044
Kyle is being granted access to a military computer system that uses System High mode. What is not true about Kyle’s security clearance requirements?
A. Kyle must have a clearance for the highest level of classification processed by the system, regardless of his access.
B. Kyle must have access approval for all information processed by the system.
C. Kyle must have a valid need to know for all information processed by the system.
D. Kyle must have a valid security clearance.
C. Kyle must have a valid need to know for all information processed by the system.
For systems running in System High mode, the user must have a valid security clearance for all information processed by the system, access approval for all information processed by the system, and a valid need to know for some, but not necessarily all, information processed by the system.
Question 15 tb787631.CISSPPT3E.c03.082
What type of motion detector senses changes in the electromagnetic fields in monitored areas?
A. Infrared
B. Wave pattern
C. Capacitance
D. Photoelectric
C. Capacitance
Capacitance motion detectors monitor the electromagnetic field in a monitored area, sensing disturbances that correspond to motion.
Question 16 tb787631.CISSPPT3E.c03.053
Chris is designing a cryptographic system for use within his company. The company has 1,000 employees, and they plan to use an asymmetric encryption system. They would like the system to be set up so that any pair of arbitrary users may communicate privately. How many total keys will they need?
A. 500
B. 1,000
C. 2,000
D. 4,950
C. 2,000
Asymmetric cryptosystems use a pair of keys for each user. In this case, with 1,000 users, the system will require 2,000 keys.
Question 17 tb787631.CISSPPT3E.c03.072
The Double DES (2DES) encryption algorithm was never used as a viable alternative to the original DES algorithm. What implementation attack is 2DES vulnerable to that does not exist for the DES or 3DES approach?
A. Chosen ciphertext
B. Brute force
C. Man-in-the-middle
D. Meet-in-the-middle
D. Meet-in-the-middle
The meet-in-the-middle attack uses a known plaintext message and uses both encryption of the plaintext and decryption of the ciphertext simultaneously in a brute-force manner to identify the encryption key in approximately double the time of a brute-force attack against the basic DES algorithm.
Question 18 tb787631.CISSPPT3E.c03.067
In a software as a service cloud computing environment, who is normally responsible for ensuring that appropriate firewall controls are in place to protect the application?
A. Customer’s security team
B. Vendor
C. Customer’s networking team
D. Customer’s infrastructure management team
B. Vendor
In a software as a service environment, the customer has no access to any underlying infrastructure, so firewall management is a vendor responsibility under the cloud computing shared responsibility model.
Question 19 tb787631.CISSPPT3E.c03.048
In an infrastructure as a service (IaaS) environment where a vendor supplies a customer with access to storage services, who is normally responsible for removing sensitive data from drives that are taken out of service?
A. Customer’s security team
B. Customer’s storage team
C. Customer’s vendor management team
D. Vendor
D. Vendor
In an infrastructure as a service environment, security duties follow a shared responsibility model. Since the vendor is responsible for managing the storage hardware, the vendor would retain responsibility for destroying or wiping drives as they are taken out of service. However, it is still the customer’s responsibility to validate that the vendor’s sanitization procedures meet their requirements prior to utilizing the vendor’s storage services.
Question 20 tb787631.CISSPPT3E.c03.001
Matthew is the security administrator for a consulting firm and must enforce access controls that restrict users’ access based upon their previous activity. For example, once a consultant accesses data belonging to Acme Cola, a consulting client, they may no longer access data belonging to any of Acme’s competitors. What security model best fits Matthew’s needs?
A. Clark-Wilson
B. Biba
C. Bell-LaPadula
D. Brewer-Nash
D. Brewer-Nash
The Brewer-Nash model allows access controls to change dynamically based upon a user’s actions. It is often used in environments like Matthew’s to implement a “Chinese wall” between data belonging to different clients.
Question 21 tb787631.CISSPPT3E.c03.091
Which one of the following humidity values is within the acceptable range for a data center operation?
A. 0 percent
B. 10 percent
C. 25 percent
D. 40 percent
D. 40 percent
Data center humidity should be maintained between 40 percent and 60 percent. Values below this range increase the risk of static electricity, while values above this range may generate moisture that damages equipment.
Question 22 tb787631.CISSPPT3E.c03.074
Warren is designing a physical intrusion detection system for use in a sensitive media storage facility and wants to include technology that issues an alert if the communications lines for the alarm system are unexpectedly cut. What technology would meet this requirement?
A. Heartbeat sensor
B. Emanation security
C. Motion detector
D. Faraday cage
A. Heartbeat sensor
Heartbeat sensors send periodic status messages from the alarm system to the monitoring center. The monitoring center triggers an alarm if it does not receive a status message for a prolonged period of time, indicating that communications were disrupted.
Question 23 tb787631.CISSPPT3E.c03.015
Chris wants to verify that a software package that he downloaded matches the original version. What hashing tool should he use if he believes that technically sophisticated attackers may have replaced the software package with a version containing a backdoor?
A. MD5
B. 3DES
C. SHA1
D. SHA 256
D. SHA 256
Intentional collisions have been created with MD5, and a real-world collision attack against SHA 1 was announced in early 2017. 3DES is not a hashing tool, leaving SHA 256 (sometimes called SHA 2) as the only real choice that Chris has in this list.
Question 24 tb787631.CISSPPT3E.c03.065
Johnson Widgets strictly limits access to total sales volume information, classifying it as a competitive secret. However, shipping clerks have unrestricted access to order records to facilitate transaction completion. A shipping clerk recently pulled all of the individual sales records for a quarter from the database and totaled them up to determine the total sales volume. What type of attack occurred?
A. Social engineering
B. Inference
C. Aggregation
D. Data diddling
C. Aggregation
In an aggregation attack, individual(s) use their access to specific pieces of information to piece together a larger picture that they are not authorized to access.
Question 25 tb787631.CISSPPT3E.c03.034
In the figure shown here, Sally is blocked from writing to the data file by the Biba integrity model. Sally has a Secret security clearance, and the file is classified Top Secret. What principle is preventing her from writing to the file?
A data flow diagram starts with a circle on the left, which represents an entity, Sally. A rounded rectangle is on the right, which represents another entity, Data File. An arrow labeled, Write Request, points from the circle to the rounded rectangle. A cross inscribed in a circle is on the arrow.
A. Simple Security Property
B. Simple Integrity Property
C. *-Security Property
D. *-Integrity Property
D. *-Integrity Property
The *-Integrity Property states that a subject cannot modify an object at a higher integrity level than that possessed by the subject.
Question 26 tb787631.CISSPPT3E.c03.014
Sonia recently removed an encrypted hard drive from a laptop and moved it to a new device because of a hardware failure. She is having difficulty accessing encrypted content on the drive despite the fact that she knows the user’s password. What hardware security feature is likely causing this problem?
A. TCB
B. TPM
C. NIACAP
D. RSA
B. TPM
The Trusted Platform Module (TPM) is a hardware security technique that stores an encryption key on a chip on the motherboard and prevents someone from accessing an encrypted drive by installing it in another computer.
Question 27 tb787631.CISSPPT3E.c03.038
Jake works for a research organization that is seeking to deploy a grid computing system that will perform cycle scavenging on user workstations to conduct research tasks that require high-performance computing. What is the most significant risk associated with this operation?
A. Data confidentiality
B. Isolation breach
C. Data integrity
D. Data availability
B. Isolation breach
The system can be designed in a manner that protects the confidentiality, integrity, and availability of data. The research workstations included in the grid are from internal users, minimizing the risk of distributing the data. However, an isolation breach in the distributed computing client could be catastrophic, allowing someone who compromises the controller to assume control of every device in the organization.
Question 28 tb787631.CISSPPT3E.c03.075
John and Gary are negotiating a business transaction, and John must demonstrate to Gary that he has access to a system. He engages in an electronic version of the “magic door” scenario shown here. What technique is John using?
An illustration shows a man standing before a horizontal narrow opening. The opening branches out upward and downward, then curves back downward and upward, respectively, to complete a closed tube like space shaped like a human eye. The line of sight of the man points downward through the narrow opening, to the inner wall of the downward branch. Another curved arrow points through the upward branch. At the point of the upper branch, where the branch begins to curve downward, a silhouette of a man is located. The eye of the silhouette is labeled, 1. The point of the lower branch, where the branch begins to curve upward, is labeled, 2. A door is situated inside the closed tube, such that the doorknob on the door is located horizontally in line to the man’s eye.
A. Split-knowledge proof
B. Zero-knowledge proof
C. Logical proof
D. Mathematical proof
B. Zero-knowledge proof
In a zero-knowledge proof, one individual demonstrates to another that they can achieve a result that requires sensitive information without actually disclosing the sensitive information.
Question 29 tb787631.CISSPPT3E.c03.032
Ryan is developing a physical access plan for his organization’s data center and wants to implement the security control indicated by the arrow in this diagram. What is the name of this control?
An enclosed square space consists of walls on each of the four sides, formed by six adjacently erected rectangles on each side. There are two gaps in the walls, one each on the bottom side and the left side. In the bottom side, the fourth rectangle from the left is replaced by a revolving door. In the left side, the first rectangle from the top is replaced by a doorway. A downward arrow points to the doorway. The top right corner of the enclosed space contains a smaller enclosed space.
A. Mantrap
B. Turnstile
C. Intrusion prevention system
D. Portal
A. Mantrap
Mantraps use two sets of doors to control access to a facility. This may be used to prevent piggybacking by monitoring use of the mantrap to allow only a single individual to enter a facility at a time. They may also be used to allow manual inspection of individuals or perform other security screening. Mantraps are also commonly known as access control vestibules.
Question 30 tb787631.CISSPPT3E.c03.081
During a third-party vulnerability scan and security test, Danielle’s employer recently discovered that the embedded systems that were installed to manage her company’s new buildings have a severe remote access vulnerability. The manufacturer has gone out of business, and there is no patch or update for the devices. What should Danielle recommend that her employer do about the hundreds of devices that are vulnerable?
A. Identify a replacement device model and replace every device.
B. Turn off all of the devices.
C. Move the devices to a secure and isolated network segment.
D. Reverse engineer the devices and build an in-house patch.
C. Move the devices to a secure and isolated network segment..
The most reasonable choice presented is to move the devices to a secure and isolated network segment. This will allow the devices to continue to serve their intended function while preventing them from being compromised. All of the other scenarios either create major new costs or deprive her organization of the functionality that the devices were purchased to provide.
Question 31 tb787631.CISSPPT3E.c03.097
Which one of the following is an example of a covert timing channel when used to exfiltrate information from an organization?
A. Sending an electronic mail message
B. Posting a file on a peer-to-peer file sharing service
C. Typing with the rhythm of Morse code
D. Writing data to a shared memory space
C. Typing with the rhythm of Morse code
Covert channels use surreptitious communications’ paths. Covert timing channels alter the use of a resource in a measurable fashion to exfiltrate information. If a user types using a specific rhythm of Morse code, this is an example of a covert timing channel. Someone watching or listening to the keystrokes could receive a secret message with no trace of the message left in logs.
Question 32 tb787631.CISSPPT3E.c03.017
Please refer to the following scenario:
Alice and Bob would like to use an asymmetric cryptosystem to communicate with each other. They are located in different parts of the country but have exchanged encryption keys by using digital certificates signed by a mutually trusted certificate authority.
When Bob receives the encrypted message from Alice, what key does he use to decrypt the message’s plaintext content?
A. Alice’s public key
B. Alice’s private key
C. Bob’s public key
D. Bob’s private key
D. Bob’s private key
When Bob receives the message, he uses his own private key to decrypt it. Since he is the only one with his private key, he is the only one who should be able to decrypt it, thus preserving confidentiality.
Question 6 tb787631.CISSPPT3E.c03.026
In the figure shown here, Harry’s request to write to the data file is blocked. Harry has a Secret security clearance, and the data file has a Confidential classification. What principle of the Bell-LaPadula model blocked this request?
A data flow diagram starts with a circle on the left, which represents an entity, Harry. A rounded rectangle is on the right, which represents another entity, Data File. An arrow labeled, Write Request, points from the circle to the rounded rectangle. A cross inscribed in a circle is on the arrow.
A. Simple Security Property
B. Simple Integrity Property
C. *-Security Property
D. Discretionary Security Property
C. *-Security Property
The *-Security Property states that an individual may not write to a file at a lower classification level than that of the individual. This is also known as the confinement property.
Question 8 tb787631.CISSPPT3E.c03.047
In the ring protection model shown here, what ring contains the operating system’s kernel?
A figure shows four concentric rings. The rings are labeled, from the innermost to the outermost ring, as follows: RING 0, RING 1, RING 2, and RING 3.
A. Ring 0
B. Ring 1
C. Ring 2
D. Ring 3
A. Ring 0
The kernel lies within the central ring, Ring 0. Conceptually, Ring 1 contains other operating system components. Ring 2 is used for drivers and protocols. User-level programs and applications run at Ring 3. Rings 0 through 2 run in privileged mode while Ring 3 runs in user mode. It is important to note that many modern operating systems do not fully implement this model.
Question 27 tb787631.CISSPPT3E.c04.013
Please refer to the following scenario and diagram:
Chris is designing layered network security for his organization.
What type of firewall design is shown in the diagram?
A. A single-tier firewall
B. A two-tier firewall
C. A three-tier firewall
D. A four-tier firewall
B. A two-tier firewall
The firewall in the diagram has two protected zones behind it, making it a two-tier firewall design.
Question 44 tb787631.CISSPPT3E.c04.100
Mikayla is reviewing her organization’s VoIP environment configuration and finds a diagram that shows the following design. What concern should she express?
A network diagram shows the communication between a V o I P phone and a V o I P P B X. An arrow, labeled S I P connection, and another arrow, labeled S R T P connection, point from the V o I P phone to the V o I P P B X.
A. The voice connection is unencrypted and could be listened to.
B. There are no security issues in this diagram.
C. The session initialization connection is unencrypted and could be viewed.
D. Both the session initialization and voice data connection are unencrypted and could be captured and analyzed.
C. The session initialization connection is unencrypted and could be viewed.
This diagram shows the use of SIP instead of SIPS, meaning that the session initialization protocol is not encrypted. Fortunately, the voice data via secure real-time transport protocol, or SRTP is encrypted. Mikayla should look into using SIPS in addition to SRTP.
Question 58 tb787631.CISSPPT3E.c04.031
Please refer to the following scenario and diagram:
Selah’s organization has used a popular messaging service for a number of years. Recently, concerns have been raised about the use of messaging.
A network diagram shows a router, a switch, a firewall, and three end devices, A, B, and C. The router is situated at the center and the switch is situated below the router. A one directional link points from the switch to the router. The router is connected to the Internet, represented above the router. A firewall is situated between the router and the Internet. A one directional link points from the router to the firewall, and another one directional link, A, points from the firewall to the Internet. A one directional link, I M traffic via T C P 80, points from the Internet to device B. A one directional link, I M traffic via T C P 80, points from device A to the switch. The switch is also connected to device C.
How could Selah’s company best address a desire for secure messaging for users of internal systems A and C?
A. Use a third-party messaging service.
B. Implement and use a locally hosted service.
C. Use HTTPS.
D. Discontinue use of messaging and instead use email, which is more secure.
B. Implement and use a locally hosted service.
If a business need requires messaging, using a local messaging server is the best option. This prevents traffic from traveling to a third-party server and can offer additional benefits such as logging, archiving, and control of security options like the use of encryption.
Question 92 tb787631.CISSPPT3E.c04.014
Please refer to the following scenario and diagram:
Chris is designing layered network security for his organization.
A network diagram shows a router, a switch, a web server, a V P N Concentrator, a firewall, and five end devices. The router, situated at the left, is connected by an interface, C, to the V P N Concentrator, situated at the right. The switch, situated below the router, is connected by an interface to the router. The Internet is represented above the router. A firewall is situated between the router and the Internet. The router is connected to the Internet through the firewall. The interface between the firewall and the Internet is labeled, A. To the right of the firewall, a Web Server is situated. The Web Server is connected to the firewall by an interface, B. The five end devices, situated below the switch, are connected to a common bus, which is connected to the switch.
If the VPN grants remote users the same access to network and system resources as local workstations have, what security issue should Chris raise?
A. VPN users will not be able to access the web server.
B. There is no additional security issue; the VPN concentrator’s logical network location matches the logical network location of the workstations.
C. Web server traffic is not subjected to stateful inspection.
D. VPN users should only connect from managed PCs.
D. VPN users should only connect from managed PCs.
Remote PCs that connect to a protected network need to comply with security settings and standards that match those required for the internal network. The VPN concentrator logically places remote users in the protected zone behind the firewall, but that means user workstations (and users) must be trusted in the same way that local workstations are.
Question 97 tb787631.CISSPPT3E.c04.074
Please refer to the following scenario:
Ben is an information security professional at an organization that is replacing its physical servers with cloud-hosted virtual machines. As the organization builds its virtual environment, it is moving toward a hybrid cloud operational model with some systems and services remaining in its local data center and others hosted in the cloud. The following diagram shows the local data center and cloud VPC’s network IP ranges, which you should consider as you answer the questions.
A network diagram shows the interconnection between a data center network having an I P address 1 0 dot 0 dot 0 dot 0 forward slash 24 and a V P C network having the same I P address.
What issue is most likely to occur due to the subnets configured for the data center and VPC?
A. IP address conflicts
B. Routing loops
C. MAC address conflicts
D. All of the above
A. IP address conflicts
Using the same IP range for an on-site and cloud-hosted data center can be helpful when designing a flat network, but addresses must be carefully managed and allocated even in a space as big as the 10.0.0.0/24 range. If addresses are not properly managed, conflicts may arise that could disrupt production services. MAC address conflicts should not arise unless addresses are manually changed or virtual machines are replicated without changing their MAC addresses. There is nothing in the problem to suggest routing issues.
