CISSP : Certified Information Systems Security Professional : Part 12
CISSP : Certified Information Systems Security Professional : Part 12
-
A security professional should ensure that clients support which secondary algorithm for digital signatures when a Secure Multipurpose Internet Mail Extension (S/MIME) is used?
- Triple Data Encryption Standard (3DES)
- Advanced Encryption Standard (AES)
- Digital Signature Algorithm (DSA)
- Rivest-Shamir-Adleman (RSA)
-
The Rivest-Shamir-Adleman (RSA) algorithm is BEST suited for which of the following operations?
- Bulk data encryption and decryption
- One-way secure hashing for user and message authentication
- Secure key exchange for symmetric cryptography
- Creating digital checksums for message integrity
-
An Intrusion Detection System (IDS) is based on the general hypothesis that a security violation is associated with a pattern of system usage, which can be
- differentiated from a normal usage pattern
- used to detect known violations
- used to detect a masquerader
- differentiated to detect all security violations
-
Which of the following is the MOST effective countermeasure against Man-in-the-Middle (MITM) attacks while using online banking?
- Transport Layer Security (TLS)
- Secure Sockets Layer (SSL)
- Pretty Good Privacy (PGP)
- Secure Shell (SSH)
-
Which of the following needs to be included in order for High Availability (HA) to continue operations during planned system outages?
- Redundant hardware, disk spanning, and patching
- Load balancing, power reserves, and disk spanning
- Backups, clustering, and power reserves
- Clustering, load balancing, and fault-tolerant options
-
Organization A is adding a large collection of confidential data records that it received when it acquired Organization B to its data store. Many of the users and staff from Organization B are no longer available.
Which of the following MUST Organization A do to properly classify and secure the acquired data?
- Assign data owners from Organization A to the acquired data
- Create placeholder accounts that represent former users from Organization B
- Archive audit records that refer to users from Organization A
- Change the data classification for data acquired from Organization B
-
A manufacturing organization wants to establish a Federated Identity Management (FIM) system with its 20 different supplier companies. Which of the following is the BEST solution for the manufacturing organization?
- Trusted third-party certification
- Lightweight Directory Access Protocol (LDAP)
- Security Assertion Markup language (SAML)
- Cross-certification
Explanation:
Reference: https://www.netiq.com/documentation/access-manager-43/applications-configuration-guide/data/b1ka6lkd.html
-
Which of the following BEST describes an access control method utilizing cryptographic keys derived from a smart card private key that is embedded within mobile devices?
- Derived credential
- Temporary security credential
- Mobile device credentialing service
- Digest authentication
-
Users require access rights that allow them to view the average salary of groups of employees. Which control would prevent the users from obtaining an individual employee’s salary?
- Limit access to predefined queries
- Segregate the database into a small number of partitions each with a separate security level
- Implement Role Based Access Control (RBAC)
- Reduce the number of people who have access to the system for statistical purposes
-
What is the BEST approach for controlling access to highly sensitive information when employees have the same level of security clearance?
- Audit logs
- Role-Based Access Control (RBAC)
- Two-factor authentication
- Application of least privilege
-
The core component of Role Based Access Control (RBAC) must be constructed of defined data elements.
Which elements are required?
- Users, permissions, operations, and protected objects
- Roles, accounts, permissions, and protected objects
- Users, roles, operations, and protected objects
- Roles, operations, accounts, and protected objects
-
Which of the following is the BEST metric to obtain when gaining support for an Identify and Access Management (IAM) solution?
- Application connection successes resulting in data leakage
- Administrative costs for restoring systems after connection failure
- Employee system timeouts from implementing wrong limits
- Help desk costs required to support password reset requests
-
In an organization where Network Access Control (NAC) has been deployed, a device trying to connect to the network is being placed into an isolated domain. What could be done on this device in order to obtain proper connectivity?
- Connect the device to another network jack
- Apply remediation’s according to security requirements
- Apply Operating System (OS) patches
- Change the Message Authentication Code (MAC) address of the network interface
-
What is the second step in the identity and access provisioning lifecycle?
- Provisioning
- Review
- Approval
- Revocation
-
Which of the following MUST be scalable to address security concerns raised by the integration of third-party identity services?
- Mandatory Access Controls (MAC)
- Enterprise security architecture
- Enterprise security procedures
- Role Based Access Controls (RBAC)
-
Which of the following is a common feature of an Identity as a Service (IDaaS) solution?
- Single Sign-On (SSO) authentication support
- Privileged user authentication support
- Password reset service support
- Terminal Access Controller Access Control System (TACACS) authentication support
-
An organization’s security policy delegates to the data owner the ability to assign which user roles have access to a particular resource. What type of authorization mechanism is being used?
- Discretionary Access Control (DAC)
- Role Based Access Control (RBAC)
- Media Access Control (MAC)
- Mandatory Access Control (MAC)
-
Extensible Authentication Protocol-Message Digest 5 (EAP-MD5) only provides which of the following?
- Mutual authentication
- Server authentication
- User authentication
- Streaming ciphertext data
-
Which of the following is the FIRST step during digital identity provisioning?
- Authorizing the entity for resource access
- Synchronizing directories
- Issuing an initial random password
- Creating the entity record with the correct attributes
-
Physical Access Control Systems (PACS) allow authorized security personnel to manage and monitor access control for subjects through which function?
- Remote access administration
- Personal Identity Verification (PIV)
- Access Control List (ACL)
- Privileged Identity Management (PIM)