CISSP-ISSAP : Information Systems Security Architecture Professional : Part 03

CISSP-ISSAP : Information Systems Security Architecture Professional : Part 03

1. In which of the following cryptographic attacking techniques does an attacker obtain encrypted messages that have been encrypted using the same encryption algorithm?

   • Chosen plaintext attack
   • Ciphertext only attack 
   • Chosen ciphertext attack
   • Known plaintext attack

2. SIMILATION

   Fill in the blank with the appropriate security device. ___________ is a device that contains a physical mechanism or electronic sensor that quantifies motion that can be either integrated with or connected to other devices that alert the user of the presence of a moving object within the field of view.

   • Motion detector

3. You work as a Chief Security Officer for Tech Perfect Inc. The company has a TCP/IP based network. You want to use a firewall that can track the state of active connections of the network and then determine which network packets are allowed to enter through the firewall. Which of the following firewalls has this feature?

   • Stateful packet inspection firewall
   • Proxy-based firewall
   • Dynamic packet-filtering firewall 
   • Application gateway firewall

4. Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur?

   • Safeguard
   • Annualized Rate of Occurrence (ARO)
   • Single Loss Expectancy (SLE)
   • Exposure Factor (EF)

5. Which of the following components come under the network layer of the OSI model? Each correct answer represents a complete solution. Choose two.

   • Routers 
   • MAC addresses
   • Firewalls 
   • Hub

6. A company named Money Builders Inc., hires you to provide consultancy for setting up their Windows network. The company’s server room will be in a highly secured environment. You are required to suggest an authentication method for it. The CFO of the company wants the server to use thumb impressions for authentication. Which of the following authentication methods will you suggest?

   • Certificate
   • Smart card
   • Two-factor
   • Biometrics

7. Which of the following SDLC phases consists of the given security controls: Misuse Case Modeling Security Design and Architecture Review Threat and Risk Modeling Security Requirements and Test Cases Generation

   • Design 
   • Maintenance
   • Deployment
   • Requirements Gathering

8. Which of the following keys are included in a certificate revocation list (CRL) of a public key infrastructure (PKI)? Each correct answer represents a complete solution. Choose two.

   • A foreign key
   • A private key
   • A public key
   • A primary key

9. You are the Security Consultant and have been contacted by a client regarding their encryption and hashing algorithms. Their in-house network administrator tells you that their current hashing algorithm is an older one with known weaknesses and is not collision resistant.Which algorithm are they most likely using for hashing?

   • PKI
   • SHA
   • Kerberos
   • MD5

10. Which of the following plans is designed to protect critical business processes from natural or man-made failures or disasters and the resultant loss of capital due to the unavailability of normal business processes?

    • Disaster recovery plan
    • Contingency plan
    • Business continuity plan 
    • Crisis communication plan

11. Shoulder surfing is a type of in-person attack in which the attacker gathers information about the premises of an organization. This attack is often performed by looking surreptitiously at the keyboard of an employee’s computer while he is typing in his password at any access point such as a terminal/Web site. Which of the following is violated in a shoulder surfing attack?

    • Integrity
    • Availability
    • Authenticity
    • Confidentiality

12. You work as a Network Administrator for Net Perfect Inc. The company has a Linux-based network. You need to configure a firewall for the company. The firewall should be able to keep track of the state of network connections traveling across the network. Which of the following types of firewalls will you configure to accomplish the task?

    • Stateful firewall 
    • Host-based application firewall
    • A network-based application layer firewall
    • An application firewall

13. Which of the following two cryptography methods are used by NTFS Encrypting File System (EFS) to encrypt the data stored on a disk on a file-by-file basis?

    • Twofish
    • Digital certificates
    • Public key
    • RSA

14. At which of the following layers of the Open System Interconnection (OSI) model the Internet Control Message Protocol (ICMP) and the Internet Group Management Protocol (IGMP) work?

    • The Physical layer
    • The Data-Link layer
    • The Network layer 
    • The Presentation layer

15. Which of the following are examples of physical controls used to prevent unauthorized access to sensitive materials?

    • Thermal alarm systems
    • Security Guards
    • Closed circuit cameras
    • Encryption

16. Which of the following statements about Discretionary Access Control List (DACL) is true?

    • It specifies whether an audit activity should be performed when an object attempts to access a resource.
    • It is a unique number that identifies a user, group, and computer account.
    • It is a list containing user accounts, groups, and computers that are allowed (or denied) access to the object. 
    • It is a rule list containing access control entries.

17. Which of the following are natural environmental threats that an organization faces? Each correct answer represents a complete solution. Choose two.

    • Strikes
    • Floods
    • Accidents
    • Storms

18. Which of the following are used to suppress electrical and computer fires? Each correct answer represents a complete solution. Choose two.

    • Halon 
    • Water
    • CO2 
    • Soda acid

19. Which of the following methods will allow data to be sent on the Internet in a secure format?

    • Serial Line Interface Protocol
    • Point-to-Point Protocol
    • Browsing
    • Virtual Private Networks

20. You are responsible for security at a building that has a lot of traffic. There are even a significant number of non-employees coming in and out of the building. You are concerned about being able to find out who is in the building at a particular time. What is the simplest way to accomplish this?

    • Implement a sign in sheet at the main entrance and route all traffic through there. 
    • Have all people entering the building use smart cards for access.
    • Implement biometric access.
    • Implement cameras at all entrances.