CISSP-ISSEP : Information Systems Security Engineering Professional : Part 08
-
Which of the following professionals is responsible for starting the Certification & Accreditation (C&A) process
- Authorizing Official
- Information system owner
- Chief Information Officer (CIO)
- Chief Risk Officer (CRO)
-
Which of the following types of firewalls increases the security of data packets by remembering the state of connection at the network and the session layers as they pass through the filter
- Stateless packet filter firewall
- PIX firewall
- Stateful packet filter firewall
- Virtual firewall
-
Which of the following is a type of security management for computers and networks in order to identify security breaches
- IPS
- IDS
- ASA
- EAP
-
FITSAF stands for Federal Information Technology Security Assessment Framework. It is a methodology for assessing the security of information systems. Which of the following FITSAF levels shows that the procedures and controls are tested and reviewed
- Level 4
- Level 5
- Level 1
- Level 2
- Level 3
-
Part of your change management plan details what should happen in the change control system for your project. Theresa, a junior project manager, asks what the configuration management activities are for scope changes. You tell her that all of the following are valid configuration management activities except for which one
- Configuration Item Costing
- Configuration Identification
- Configuration Verification and Auditing
- Configuration Status Accounting
-
Which of the following is used to indicate that the software has met a defined quality level and is ready for mass distribution either by electronic means or by physical media
- ATM
- RTM
- CRO
- DAA
-
Which of the following federal laws is designed to protect computer data from theft
- Federal Information Security Management Act (FISMA)
- Computer Fraud and Abuse Act (CFAA)
- Government Information Security Reform Act (GISRA)
- Computer Security Act
-
Which of the following Registration Tasks sets up the business or operational functional description and system identification
- Registration Task 2
- Registration Task 1
- Registration Task 3
- Registration Task 4
-
What are the responsibilities of a system owner Each correct answer represents a complete solution. Choose all that apply.
- Integrates security considerations into application and system purchasing decisions and development projects.
- Ensures that the necessary security controls are in place.
- Ensures that adequate security is being provided by the necessary controls, password management, remote access controls, operating system configurations, and so on.
- Ensures that the systems are properly assessed for vulnerabilities and must report any to the incident response team and data owner.
-
DoD 8500.2 establishes IA controls for information systems according to the Mission Assurance Categories (MAC) and confidentiality levels. Which of the following MAC levels requires basic integrity and availability
- MAC I
- MAC II
- MAC IV
- MAC III
-
Which of the following statements is true about residual risks
- It can be considered as an indicator of threats coupled with vulnerability.
- It is a weakness or lack of safeguard that can be exploited by a threat.
- It is the probabilistic risk after implementing all security measures.
- It is the probabilistic risk before implementing all security measures.
-
Which of the following federal agencies provides a forum for the discussion of policy issues, sets national policy, and promulgates direction, operational procedures, and guidance for the security of national security systems
- National Security AgencyCentral Security Service (NSACSS)
- National Institute of Standards and Technology (NIST)
- United States Congress
- Committee on National Security Systems (CNSS)
-
SIMULATION
Fill in the blank with an appropriate section name. _________________ is a section of the SEMP template, which specifies the methods and reasoning planned to build the requisite trade-offs between functionality, performance, cost, and risk.
System Analysis
-
Which of the following documents is defined as a source document, which is most useful for the ISSE when classifying the needed security functionality
- Information Protection Policy (IPP)
- IMM
- System Security Context
- CONOPS
-
Which of the following email lists is written for the technical audiences, and provides weekly summaries of security issues, new vulnerabilities, potential impact, patches and workarounds, as well as the actions recommended to mitigate risk
- Cyber Security Tip
- Cyber Security Alert
- Cyber Security Bulletin
- Technical Cyber Security Alert
-
The Phase 4 of DITSCAP C&A is known as Post Accreditation. This phase starts after the system has been accredited in Phase 3. What are the process activities of this phase Each correct answer represents a complete solution. Choose all that apply.
- Security operations
- Continue to review and refine the SSAA
- Change management
- Compliance validation
- System operations
- Maintenance of the SSAA
-
Which of the following processes culminates in an agreement between key players that a system in its current configuration and operation provides adequate protection controls
- Certification and accreditation (C&A)
- Risk Management
- Information systems security engineering (ISSE)
- Information Assurance (IA)
-
Which of the following elements are described by the functional requirements task Each correct answer represents a complete solution. Choose all that apply.
- Coverage
- Accuracy
- Quality
- Quantity
-
Which of the following documents were developed by NIST for conducting Certification & Accreditation (C&A) Each correct answer represents a complete solution. Choose all that apply.
- NIST Special Publication 800-59
- NIST Special Publication 800-60
- NIST Special Publication 800-37A
- NIST Special Publication 800-37
- NIST Special Publication 800-53
- NIST Special Publication 800-53A
-
Which of the following tasks obtains the customer agreement in planning the technical effort
- Task 9
- Task 11
- Task 8
- Task 10
Subscribe
0 Comments
Newest