Nov 25, 2024 Updated CSSLP Dumps Questions For ISC Exam [Q171-Q194]

Nov 25, 2024 Updated CSSLP Dumps Questions For ISC Exam

Best Value Available Preparation Guide for CSSLP Exam

Secure Software Prerequisites (14%):

• Recognize and evaluate compliance prerequisites;
• Recognize and evaluate privacy prerequisites, including data anonymization, data retention, user consent, cross borders, and disposition;
• Ensure security prerequisites flow down to providers/suppliers.
• Develop abuse and misuse cases;
• Recognize and evaluate data classification prerequisites, including data ownership, data types, labeling, and data lifecycle;
• Establish security prerequisite traceability matrix;

Secure Software Operations, Deployment & Maintenance (12%):

• Incorporate SLO and SLA;
• Securely release software – This subject area covers secure software tool-chain, develop artifact verification, and secure CI/CD pipelines;
• Runtime protection.
• Securely manage and store security data, including secrets, credentials, configurations, and key/certificates;
• Carry out patch management;
• Ensure a secure installation, including least privilege, bootstrapping, security policy implementation, secure activation, secrets injection, and environment hardening;

ISC2 CSSLP Exam Syllabus Topics:

Topic	Details
Secure Software Concepts - 10%
Core Concepts	- Confidentiality (e.g., covert, overt, encryption) - Integrity (e.g., hashing, digital signatures, code signing, reliability, modifications, authenticity) - Availability (e.g., redundancy, replication, clustering, scalability, resiliency) - Authentication (e.g., multifactor authentication (MFA), identity & access management (IAM), single sign-on (SSO), federated identity) - Authorization (e.g., access controls, permissions, entitlements) - Accountability (e.g., auditing, logging) - Nonrepudiation (e.g., digital signatures, block chain)
Security Design Principles	- Least privilege (e.g., access control, need-to-know, run-time privileges) - Separation of duties (e.g., multi-party control, secret sharing and split knowledge) - Defense in depth (e.g., layered controls, input validation, security zones) - Resiliency (e.g., fail safe, fail secure, no Single Point of Failure (SPOF)) - Economy of mechanism (e.g., Single Sign-On (SSO), password vaults, resource) - Complete mediation (e.g., cookie management, session management, caching of credentials) - Open design (e.g., Kerckhoffs's principle) - Least common mechanism (e.g., compartmentalization/isolation, white-listing) - Psychological acceptability (e.g., password complexity, screen layouts, Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA), biometrics) - Component reuse (e.g., common controls, libraries) - Diversity of defense (e.g., geographical diversity, technical diversity, distributed systems)
Secure Software Requirements - 14%
Define Software Security Requirements	- Functional (e.g., business requirements, use cases, stories) - Non-functional (e.g., operational, deployment, systemic qualities)
Identify and Analyze Compliance Requirements
Identify and Analyze Data Classification Requirements	- Data ownership (e.g., data owner, data custodian) - Labeling (e.g., sensitivity, impact) - Types of data (e.g., structured, unstructured data) - Data life-cycle (e.g., generation, retention, disposal)
Identify and Analyze Privacy Requirements	- Data anonymization - User consent - Disposition (e.g., right to be forgotten) - Data retention - Cross borders (e.g., data residency, jurisdiction, multi-national data processing boundaries)
Develop Misuse and Abuse Cases
Develop Security Requirement Traceability Matrix (STRM)
Ensure Security Requirements Flow Down to Suppliers/Providers
Secure Software Architecture and Design - 14%
Perform Threat Modeling	- Understand common threats (e.g., Advance Persistent Threat (APT), insider threat, common malware, third-party/supplier) - Attack surface evaluation - Threat intelligence (e.g., Identify credible relevant threats)
Define the Security Architecture	- Security control identification and prioritization - Distributed computing (e.g., client server, peer-to-peer (P2P), message queuing) - Service-oriented architecture (SOA) (e.g., Enterprise Service Bus (ESB), web services) - Rich internet applications (e.g., client-side exploits or threats, remote code execution, constant connectivity) - Pervasive/ubiquitous computing (e.g., Internet of Things (IoT), wireless, location-based, Radio-Frequency Identification (RFID), near field communication, sensor networks) - Embedded (e.g., secure update, Field-Programmable Gate Array (FPGA) security features, microcontroller security) - Cloud architectures (e.g., Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS)) - Mobile applications (e.g., implicit data collection privacy) - Hardware platform concerns (e.g., side-channel mitigation, speculative execution mitigation, embedded Hardware Security Modules (HSM)) - Cognitive computing (e.g., Machine Learning (ML), Artificial Intelligence (AI)) - Control systems (e.g., industrial, medical, facility-related, automotive)
Performing Secure Interface Design	- Security management interfaces, Out-of-Band (OOB) management, log interfaces - Upstream/downstream dependencies (e.g., key and data sharing between apps) - Protocol design choices (e.g., Application Programming Interface (APIs), weaknesses, state, models)
Performing Architectural Risk Assessment
Model (Non-Functional) Security Properties and Constraints
Model and Classify Data
Evaluate and Select Reusable Secure Design	- Credential management (e.g., X.509 and Single Sign-On (SSO)) - Flow control (e.g., proxies, firewalls, protocols, queuing) - Data loss prevention (DLP) - Virtualization (e.g., software defined infrastructure, hypervisor, containers) - Trusted computing (e.g., Trusted Platform Module (TPM), Trusted Computing Base (TCB)) - Database security (e.g., encryption, triggers, views, privilege management) - Programming language environment (e.g., Common Language Runtime (CLR), Java Virtual Machine (JVM)) - Operating System (OS) controls and services - Secure backup and restoration planning - Secure data retention, retrieval, and destruction
Perform Security Architecture and Design Review
Define Secure Operational Architecture (e.g., deployment topology, operational interfaces)
Use Secure Architecture and Design Principles, Patterns, and Tools
Secure Software Implementation - 14%
Adhere to Relevant Secure Coding Practices (e.g., standards, guidelines and regulations)	- Declarative versus imperative (programmatic) security - Concurrency (e.g., thread safety, database concurrency controls) - Output sanitization (e.g., encoding, obfuscation) - Error and exception handling - Input validation - Secure logging & auditing - Session management - Trusted/Untrusted Application Programming Interface (APIs), and libraries - Type safety - Resource management (e.g., compute, storage, network, memory management) - Secure configuration management (e.g., parameter, default options, credentials) - Tokenizing - Isolation (e.g., sandboxing, virtualization, containers, Separation Kernel Protection Profiles (SKPP)) - Cryptography (e.g., payload, field level, transport, storage, agility, encryption, algorithm selection) - Access control (e.g., trust zones, function permissions, Role Based Access Control (RBAC)) - Processor microarchitecture security extensions (e.g., Software Guard Extensions (SGX), Advanced Micro Devices (AMD) Secure Memory Encryption(SME)/Secure Encrypted Virtualization(SEV), ARM TrustZone)
Analyze Code for Security Risks	- Secure code reuse - Vulnerability databases/lists (e.g., Open Web Application Security Project (OWASP) Top 10, Common Weakness Enumeration (CWE)) - Static Application Security Testing (SAST) (e.g., automated code coverage, linting) - Dynamic Application Security Testing (DAST) - Manual code review (e.g., individual, peer) - Look for malicious code (e.g., backdoors, logic bombs, high entropy) - Interactive Application Security Testing (IAST)
Implement Security Controls (e.g., watchdogs, File Integrity Monitoring (FIM), anti-malware)
Address Security Risks (e.g. remediation, mitigation, transfer, accept)
Securely Reuse Third-Party Code or Libraries (e.g., Software Composition Analysis (SCA))
Securely Integrate Components	- Systems-of-systems integration (e.g., trust contracts, security testing and analysis)
Apply Security During the Build Process	- Anti-tampering techniques (e.g., code signing, obfuscation) - Compiler switches - Address compiler warnings
Secure Software Testing - 14%
Develop Security Test Cases	- Attack surface validation - Penetration tests - Fuzzing (e.g., generated, mutated) - Scanning (e.g., vulnerability, content, privacy) - Simulation (e.g., simulating production environment and production data, synthetic workloads) - Failure (e.g., fault injection, stress testing, break testing) - Cryptographic validation (e.g., Pseudo-Random Number Generator (PRNG), entropy) - Regression tests - Integration tests - Continuous (e.g., synthetic transactions)
Develop Security Testing Strategy and Plan	- Functional security testing (e.g., logic) - Nonfunctional security testing (e.g., reliability, performance, scalability) - Testing techniques (e.g., white box and black box) - Environment (e.g., interoperability, test harness) - Standards (e.g., International Organization for Standardization (ISO), Open Source Security Testing Methodology Manual (OSSTMM), Software Engineering Institute (SEI)) - Crowd sourcing (e.g., bug bounty)
Verify and Validate Documentation (e.g., installation and setup instructions, error messages, user guides, release notes)
Identify Undocumented Functionality
Analyze Security Implications of Test Results (e.g., impact on product management, prioritization, break build criteria)
Classify and Track Security Errors	- Bug tracking (e.g., defects, errors and vulnerabilities) - Risk Scoring (e.g., Common Vulnerability Scoring System (CVSS))
Secure Test Data	- Generate test data (e.g., referential integrity, statistical quality, production representative) - Reuse of production data (e.g., obfuscation, sanitization, anonymization, tokenization, data aggregation mitigation)
Perform Verification and Validation Testing
Secure Software Lifecycle Management - 11%
Secure Configuration and Version Control (e.g., hardware, software, documentation, interfaces, patching)
Define Strategy and Roadmap
Manage Security Within a Software Development Methodology	- Security in adaptive methodologies (e.g., Agile methodologies) - Security in predictive methodologies (e.g., Waterfall)
Identify Security Standards and Frameworks
Define and Develop Security Documentation
Develop Security Metrics (e.g., defects per line of code, criticality level, average remediation time, complexity)

 

NEW QUESTION # 171
DRAG DROP
RCA (root cause analysis) is an iterative and reactive method that identifies the root cause of various incidents, and the actions required to prevent these incidents from reoccurring. RCA is classified in various categories. Choose appropriate categories and drop them in front of their respective functions.

Answer:

Explanation:

Explanation:

The various categories of root cause analysis (RCA) are as follows: Safety-based RC A.
It consists of plans from the health and safety areas. Production-based RCA. It integrates quality control paradigms. Process-based RCA. It integrates business processes. Failure-based RCA. It integrates failure analysis processes as employed in engineering and maintenance. Systems-based RCA. It integrates the methods from risk and systems analysis.

NEW QUESTION # 172
Which of the following ensures that a party to a dispute cannot deny the authenticity of their signature on a document or the sending of a message that they originated?

• A. OS fingerprinting
• B. Non-repudiation
• C. Reconnaissance
• D. Confidentiality

Answer: B

Explanation:
Non-repudiation is a term that refers to the ability to ensure that a party to a dispute cannot deny the authenticity of their signature on a document or the sending of a message that they originated. Non-repudiation is the concept of ensuring that a party in a dispute cannot refuse to acknowledge, or refute the validity of a statement or contract. As a service, it provides proof of the integrity and origin of data. Although this concept can be applied to any transmission, including television and radio, by far the most common application is in the verification and trust of signatures. Answer A is incorrect. Confidentiality is a mechanism that ensures that only the intended and authorized recipients are able to read data. The data is so encrypted that even if an unauthorized user gets access to it, he will not get any meaning out of it. Answer C is incorrect. Reconnaissance is a term that refers to information gathering behaviors that aim to profile the organization, employees, network, and systems before an attack is performed efficiently. It is the first step in the process of intrusion and involves unauthorized discovery and mapping of systems, services, or vulnerabilities. These discovery and mapping techniques are commonly known as scanning and enumeration. Common tools, commands, and utilities used for scanning and enumeration include ping, telnet, nslookup, rpcinfo, File Explorer, finger, etc. Reconnaissance activities take place before performing a malicious attack. These activities are used to increase the probability of successful operation against the target, and to increase the probability of hiding the attacker's identity. Answer B is incorrect. OS fingerprinting is a process in which an external host sends special traffic on the external network interface of a computer to determine the computer's operating system. It is one of the primary steps taken by hackers in preparing an attack.

NEW QUESTION # 173
Which of the following is the duration of time and a service level within which a business process must be restored after a disaster in order to avoid unacceptable consequences associated with a break in business continuity?

• A. RTA
• B. RPO
• C. RTO
• D. RCO

Answer: C

Explanation:
The Recovery Time Objective (RTO) is the duration of time and a service level within which a business process must be restored after a disaster or disruption in order to avoid unacceptable consequences associated with a break in business continuity. It includes the time for trying to fix the problem without a recovery, the recovery itself, tests and the communication to the users. Decision time for user representative is not included. The business continuity timeline usually runs parallel with an incident management timeline and may start at the same, or different, points. In accepted business continuity planning methodology, the RTO is established during the Business Impact Analysis (BIA) by the owner of a process (usually in conjunction with the Business Continuity planner). The RTOs are then presented to senior management for acceptance. The RTO attaches to the business process and not the resources required to support the process. Answer B is incorrect. The Recovery Time Actual (RTA) is established during an exercise, actual event, or predetermined based on recovery methodology the technology support team develops. This is the time frame the technology support takes to deliver the recovered infrastructure to the business. Answer D is incorrect. The Recovery Consistency Objective (RCO) is used in Business Continuity Planning in addition to Recovery Point Objective (RPO) and Recovery Time Objective (RTO). It applies data consistency objectives to Continuous Data Protection services. Answer C is incorrect. The Recovery Point Objective (RPO) describes the acceptable amount of data loss measured in time. It is the point in time to which data must be recovered as defined by the organization. The RPO is generally a definition of what an organization determines is an "acceptable loss" in a disaster situation. If the RPO of a company is 2 hours and the time it takes to get the data back into production is 5 hours, the RPO is still 2 hours. Based on this RPO the data must be restored to within 2 hours of the disaster.

NEW QUESTION # 174
Which of the following is a formula, practice, process, design, instrument, pattern, or compilation of information which is not generally known, but by which a business can obtain an economic advantage over its competitors?

• A. Explanation:
  A trade secret is a formula, practice, process, design, instrument, pattern, or compilation of information which is not generally known. It helps a business to obtain an economic advantage over its competitors or customers. In some jurisdictions, such secrets are referred to as confidential information or classified information.
• B. Trade secret
• C. Utility model
• D. Cookie
• E. Copyright

Answer: B

Explanation:
is incorrect. A copyright is a form of intellectual property, which secures to its holder the exclusive right to produce copies of his or her works of original expression, such as a literary work, movie, musical work or sound recording, painting, photograph, computer program, or industrial design, for a defined, yet extendable, period of time. It does not cover ideas or facts. Copyright laws protect intellectual property from misuse by other individuals. Answer B is incorrect. A utility model is an intellectual property right to protect inventions. Answer D is incorrect. A cookie is a small bit of text that accompanies requests and pages as they move between Web servers and browsers. It contains information that is read by a Web application, whenever a user visits a site. Cookies are stored in the memory or hard disk of client computers. A Web site stores information, such as user preferences and settings in a cookie. This information helps in providing customized services to users. There is absolutely no way a Web server can access any private information about a user or his computer through cookies, unless a user provides the information. A Web server cannot access cookies created by other Web servers.

NEW QUESTION # 175
What are the differences between managed and unmanaged code technologies? Each correct answer represents a complete solution. Choose two.

• A. C and C++ are the examples of managed code, whereas Java EE and Microsoft.NET are the examples of unmanaged code.
• B. Managed code executes under management of a runtime environment, whereas unmanaged code is executed by the CPU of a computer system.
• C. Managed code is referred to as Hex code, whereas unmanaged code is referred to as byte code.
• D. Managed code is compiled into an intermediate code format, whereas unmanaged code is compiled into machine code.

Answer: B,D

Explanation:
Explanation/Reference:
Explanation: Programming languages are categorized into two technologies: 1.Managed code: This computer program code is compiled into an intermediate code format. Managed code is referred to as byte code. It executes under the management of a runtime environment. Java EE and Microsoft.NET are the examples of managed code. 2.Unmanaged code: This computer code is compiled into machine code.
Unmanaged code is executed by the CPU of a computer system. C and C++ are the examples of unmanaged code. AnswerA is incorrect. Managed code is referred to as byte code. Answer B is incorrect. C and C++ are the examples of unmanaged code, whereas Java EE and Microsoft.NET are the examples of managed code.

NEW QUESTION # 176
The service-oriented modeling framework (SOMF) introduces five major life cycle modeling activities that drive a service evolution during design-time and run-time. Which of the following activities integrates SOA software assets and establishes SOA logical environment dependencies?

• A. Service-oriented business integration modeling
• B. Service-oriented discovery and analysis modeling
• C. Service-oriented logical architecture modeling
• D. Service-oriented logical design modeling

Answer: C

Explanation:
The service-oriented logical architecture modeling integrates SOA software assets and establishes SOA logical environment dependencies. It also offers foster service reuse, loose coupling and consolidation. Answer A is incorrect. The service-oriented discovery and analysis modeling discovers and analyzes services for granularity, reusability, interoperability, loose-coupling, and identifies consolidation opportunities. Answer B is incorrect. The service-oriented business integration modeling identifies service integration and alignment opportunities with business domains' processes. Answer D is incorrect. The service-oriented logical design modeling establishes service relationships and message exchange paths.

NEW QUESTION # 177
Which of the following steps of the LeGrand Vulnerability-Oriented Risk Management method determines the necessary compliance offered by risk management practices and assessment of risk levels?

• A. Vulnerability management
• B. Risk assessment
• C. Assessment, monitoring, and assurance
• D. Adherence to security standards and policies for development and deployment

Answer: C

Explanation:
Assessment, monitoring, and assurance determines the necessary compliance that are offered by risk management practices and assessment of risk levels.

NEW QUESTION # 178
Which of the following plans is a comprehensive statement of consistent actions to be taken before, during, and after a disruptive event that causes a significant loss of information systems resources?

• A. Contingency plan
• B. Disaster recovery plan
• C. Business Continuity plan
• D. Continuity of Operations plan

Answer: B

Explanation:
A disaster recovery plan is a complete statement of reliable actions to be taken before, during, and after a disruptive event that causes a considerable loss of information systems resources. The chief objective of a disaster recovery plan is to provide an organized way to make decisions if a disruptive event occurs. Disaster recovery planning is a subset of a larger process known as business continuity planning and should include planning for resumption of applications, data, hardware, communications (such as networking), and other IT infrastructure. A business continuity plan (BCP) includes planning for non-IT related aspects such as key personnel, facilities, crisis communication, and reputation protection, and should refer to the disaster recovery plan (DRP) for IT-related infrastructure recovery/continuity. Answer D is incorrect. Business Continuity Planning (BCP) is the creation and validation of a practiced logistical plan for how an organization will recover and restore partially or completely interrupted critical (urgent) functions within a predetermined time after a disaster or extended disruption. The logistical plan is called a business continuity plan. Answer B is incorrect. The Continuity Of Operation Plan (COOP) refers to the preparations and institutions maintained by the United States government, providing survival of federal government operations in the case of catastrophic events. It provides procedures and capabilities to sustain an organization's essential. COOP is the procedure documented to ensure persistent critical operations throughout any period where normal operations are unattainable. Answer A is incorrect. A contingency plan is a plan devised for a specific situation when things could go wrong. Contingency plans are often devised by governments or businesses who want to be prepared for anything that could happen. Contingency plans include specific strategies and actions to deal with specific variances to assumptions resulting in a particular problem, emergency, or state of affairs. They also include a monitoring process and "triggers" for initiating planned actions. They are required to help governments, businesses, or individuals to recover from serious incidents in the minimum time with minimum cost and disruption.

NEW QUESTION # 179
DRAG DROP
Drag and drop the appropriate principle documents in front of their respective functions.

Answer:

Explanation:


The various principle documents of transformation are as follows: CNSSP 22: It establishes a national risk management policy for national security systems. CNSSI 1199: It creates the technique in which the national security community classifies the information and information systems with regard to confidentiality, integrity, and availability. CNSSI 1253: It combines DCID 6/3, DOD Instructions 8500.2, NIST SP 800-53, and other security sources into a single cohesive repository of security controls. CNSSI 1253 A.
It offers the techniques to assess adequacy of each security control. CNSSI 1260: It provides guidance to organizations with the characterization of their information and information systems. NIST 800-37, Revision 1: It defines the certification and accreditation (C & A) process. The NIST 800-37, Revision 1 is a combination of DNI, DoD, and NIST.

NEW QUESTION # 180
Which of the following methods can be helpful to eliminate social engineering threat? Each correct answer represents a complete solution. Choose three.

• A. Data classification
• B. Vulnerability assessments
• C. Password policies
• D. Data encryption

Answer: A,B,C

Explanation:
Explanation/Reference:
Explanation: The following methods can be helpful to eliminate social engineering threat: Password policies Vulnerability assessments Data classification Password policy should specify that how the password can be shared. Company should implement periodic penetration and vulnerability assessments.
These assessments usually consist of using known hacker tools and common hacker techniques to breach a network security. Social engineering should also be used for an accurate assessment. Since social engineers use the knowledge of others to attain information, it is essential to have a data classification model in place that all employees know and follow. Data classification assigns level of sensitivity of company information. Each classification level specifies that who can view and edit data, and how it can be shared.

NEW QUESTION # 181
Which of the following are the responsibilities of the owner with regard to data in an information classification program? Each correct answer represents a complete solution. Choose three.

• A. Delegating the responsibility of the data protection duties to a custodian.
• B. Determining what level of classification the information requires.
• C. Reviewing the classification assignments at regular time intervals and making changes as the business needs change.
• D. Running regular backups and routinely testing the validity of the backup data.

Answer: A,B,C

Explanation:
Explanation/Reference:
Explanation: The following are the responsibilities of the owner with regard to data in an information classification program: Determining what level of classification the information requires. Reviewing the classification assignments at regular time intervals and making changes as the business needs change.
Delegating the responsibility of the data protection duties to a custodian. An information owner can be an executive or a manager of an organization. He will be responsible for the asset of information that must be protected. AnswerB is incorrect. Running regular backups and routinely testing the validity of the backup data is the responsibility of a custodian.

NEW QUESTION # 182
Which of the following areas of information system, as separated by Information Assurance Framework, is a collection of local computing devices, regardless of physical location, that are interconnected via local area networks (LANs) and governed by a single security policy?

• A. Networks and Infrastructures
• B. Local Computing Environments
• C. Supporting Infrastructures
• D. Enclave Boundaries

Answer: D

Explanation:
Explanation/Reference:
Explanation: The areas of information system, as separated by Information Assurance Framework, are as follows: Local Computing Environments: This area includes servers, client workstations, operating system, and applications. Enclave Boundaries: This area consists of collection of local computing devices, regardless of physical location, that are interconnected via local area networks (LANs) and governed by a single security policy. Networks and Infrastructures: This area provides the network connectivity between enclaves. It includes operational area networks (OANs), metropolitan area networks (MANs), and campus area networks (CANs). Supporting Infrastructures: This area provides security services for networks, client workstations, Web servers, operating systems, applications, files, and single-use infrastructure machines

NEW QUESTION # 183
Security Test and Evaluation (ST&E) is a component of risk assessment. It is useful in discovering system vulnerabilities. For what purposes is ST&E used? Each correct answer represents a complete solution. Choose all that apply.

• A. To uncover design, implementation, and operational flaws that may allow the violation of security policy
• B. To assess the degree of consistency between the system documentation and its implementation
• C. To implement the design of system architecture
• D. To determine the adequacy of security mechanisms, assurances, and other properties to enforce the security policy

Answer: A,B,D

Explanation:
Security Test and Evaluation (ST&E) is a component of risk assessment. It is useful in discovering system vulnerabilities. According to NIST SP 800-42 (Guideline on Network Security Testing), ST&E is used for the following purposes: To assess the degree of consistency between the system documentation and its implementation To determine the adequacy of security mechanisms, assurances, and other properties to enforce the security policy To uncover design, implementation, and operational flaws that may allow the violation of security policy Answer A is incorrect. ST&E is not used for the implementation of the system architecture.

NEW QUESTION # 184
What component of the change management system is responsible for evaluating, testing, and documenting changes created to the project scope?

• A. Project Management Information System
• B. Scope Verification
• C. Configuration Management System
• D. Integrated Change Control

Answer: C

Explanation:
The change management system is comprised of several components that guide the change request through the process. When a change request is made that will affect the project scope. The Configuration Management System evaluates the change request and documents the features and functions of the change on the project scope.

NEW QUESTION # 185
DRAG DROP
Auditing is used to track user accounts for file and object access, logon attempts, system shutdown, and many more vulnerabilities to enhance the security of the network. It encompasses a wide variety of activities. Place the different auditing activities in front of their descriptions.

Answer:

Explanation:

Explanation:
Auditing encompasses a wide variety of activities as follows: Logging: It is the activity of recording information to a log file or database about events or occurrences. Log Analysis: It is a systematic form of monitoring where the logged information is analyzed in detail. It is done to find out the trends and patterns as well as abnormal, unauthorized, illegal, and policy-violating activities.
Intrusion Detection: It is a process to detect unwanted system access by monitoring both recorded information and real time events. Alarm Triggers: These are the notifications that are sent to an administrator whenever a specific event occurs. Monitoring: It is the activity of manually or programmatically reviewing logged information.

NEW QUESTION # 186
Which of the following is a set of exclusive rights granted by a state to an inventor or his assignee for a fixed period of time in exchange for the disclosure of an invention?

• A. Snooping
• B. Utility model
• C. Copyright
• D. Patent

Answer: D

Explanation:
A patent is a set of exclusive rights granted by a state to an inventor or his assignee for a fixed period of time in exchange for the disclosure of an invention. Answer A is incorrect. A copyright is a form of intellectual property, which secures to its holder the exclusive right to produce copies of his or her works of original expression, such as a literary work, movie, musical work or sound recording, painting, photograph, computer program, or industrial design, for a defined, yet extendable, period of time. It does not cover ideas or facts. Copyright laws protect intellectual property from misuse by other individuals. Answer B is incorrect. Snooping is an activity of observing the content that appears on a computer monitor or watching what a user is typing. Snooping also occurs by using software programs to remotely monitor activity on a computer or network device. Hackers or attackers use snooping techniques and equipment such as keyloggers to monitor keystrokes, capture passwords and login information, and to intercept e-mail and other private communications. Sometimes, organizations also snoop their employees legitimately to monitor their use of organizations' computers and track Internet usage. Answer C is incorrect. A utility model is an intellectual property right to protect inventions.

NEW QUESTION # 187
You work as a security engineer for BlueWell Inc. According to you, which of the following DITSCAP/NIACAP model phases occurs at the initiation of the project, or at the initial C&A effort of a legacy system?

• A. Definition
• B. Post Accreditation
• C. Verification
• D. Validation

Answer: A

Explanation:
The definition phase of the DITSCAP/NIACAP model takes place at the beginning of the project, or at the initial C&A effort of a legacy system. C&A consists of four phases in a DITSCAP assessment. These phases are the same as NIACAP phases. The order of these phases is as follows: 1.Definition: The definition phase is focused on understanding the IS business case, the mission, environment, and architecture. This phase determines the security requirements and level of effort necessary to achieve Certification & Accreditation (C&A). 2.Verification: The second phase confirms the evolving or modified system's compliance with the information. The verification phase ensures that the fully integrated system will be ready for certification testing. 3.Validation: The third phase confirms abidance of the fully integrated system with the security policy. This phase follows the requirements slated in the SSAA. The objective of the validation phase is to show the required evidence to support the DAA in accreditation process. 4.Post Accreditation: The Post Accreditation is the final phase of DITSCAP assessment and it starts after the system has been certified and accredited for operations. This phase ensures secure system management, operation, and maintenance to save an acceptable level of residual risk.

NEW QUESTION # 188
DRAG DROP
Security code review identifies the unvalidated input calls made by an attacker and avoids those calls to be processed by the server. It performs various review checks on the stained calls of servlet for identifying unvalidated input from the attacker. Choose the appropriate review checks and drop them in front of their respective functions.

Answer:

Explanation:


The various security code review checks performed on the stained calls of servlet are as follows: getParameter(): It is used to check the unvalidated sources of input from URL parameters in javax.servlet.HttpServletRequest class. getQueryString(): It is used to check the unvalidated sources of input from Form fields in javax.servlet.HttpServletRequest class. getCookies(): It is used to check the unvalidated sources of input from Cookies javax.servlet.HttpServletRequest class. getHeaders(): It is used to check the unvalidated sources of input from HTTP headers javax.servlet.HttpServletRequest class.

NEW QUESTION # 189
Which of the following are examples of the application programming interface (API)? Each correct answer represents a complete solution. Choose three.

• A. HTML
• B. PHP
• C. Perl
• D. .NET

Answer: B,C,D

Explanation:
Perl, .NET, and PHP are examples of the application programming interface (API). API is a set of routines, protocols, and tools that users can use to work with a component, application, or operating system. It consists of one or more DLLs that provide specific functionality. API helps in reducing the development time of applications by reducing application code. Most operating environments, such as MS-Windows, provide an API so that programmers can write applications consistent with the operating environment. Answer A is incorrect. HTML stands for Hypertext Markup Language. It is a set of markup symbols or codes used to create Web pages and define formatting specifications. The markup tells the Web browser how to display the content of the Web page.

NEW QUESTION # 190
You work as a project manager for BlueWell Inc. You with your team are using a method or a (technical) process that conceives the risks even if all theoretically possible safety measures would be applied. One of your team member wants to know that what is a residual risk. What will you reply to your team member?

• A. It is a risk that can not be addressed by a risk response.
• B. It is a risk that remains after planned risk responses are taken.
• C. It is a risk that will remain no matter what type of risk response is offered.
• D. It is a risk that remains because no risk response is taken.

Answer: B

Explanation:
Explanation/Reference:
Explanation: Residual risks are generally smaller risks that remain in the project after larger risks have been addressed. The residual risk is the risk or danger of an action or an event, a method or a (technical) process that still conceives these dangers even if all theoretically possible safety measures would be applied. The formula to calculate residual risk is (inherent risk) x (control risk) where inherent risk is (threats vulnerability). Answer: B is incorrect. This is not a valid statement about residual risks. Answer: C is incorrect. This is not a valid statement about residual risks. Answer: A is incorrect. This is not a valid statement about residual risks.

NEW QUESTION # 191
Which of the following plans is documented and organized for emergency response, backup operations, and recovery maintained by an activity as part of its security program that will ensure the availability of critical resources and facilitates the continuity of operations in an emergency situation?

• A. Disaster Recovery Plan
• B. Contingency Plan
• C. Continuity Of Operations Plan
• D. Business Continuity Plan

Answer: B

Explanation:
Explanation/Reference:
Explanation: Contingency plan is prepared and documented for emergency response, backup operations, and recovery maintained by an activity as the element of its security program that will ensure the availability of critical resources and facilitates the continuity of operations in an emergency situation. A contingency plan is a plan devised for a specific situation when things could go wrong. Contingency plans are often devised by governments or businesses who want to be prepared for anything that could happen.
Contingency plans include specific strategies and actions to deal with specific variances to assumptions resulting in a particular problem, emergency, or state of affairs. They also include a monitoring process and
"triggers" for initiating planned actions. They are required to help governments, businesses, or individuals to recover from serious incidents in the minimum time with minimum cost and disruption.
AnswerD is incorrect. A disaster recovery plan should contain data, hardware, and software that can be
critical for a business. It should also include the plan for sudden loss such as hard disc crash. The business should use backup and data recovery utilities to limit the loss of data. AnswerA is incorrect. The Continuity Of Operation Plan (COOP) refers to the preparations and institutions maintained by the United States government, providing survival of federal government operations in the case of catastrophic events.
It provides procedures and capabilities to sustain an organization's essential. COOP is the procedure documented to ensure persistent critical operations throughout any period where normal operations are unattainable. AnswerB is incorrect. Business Continuity Planning (BCP) is the creation and validation of a practiced logistical plan for how an organization will recover and restore partially or completely interrupted critical (urgent) functions within a predetermined time after a disaster or extended disruption. The logistical plan is called a business continuity plan.

NEW QUESTION # 192
Which of the following is generally used in packages in order to determine the package or product tampering?

• A. Tamper proof
• B. Tamper data
• C. Tamper resistance
• D. Tamper evident

Answer: C

Explanation:
Tamper resistance is resistance tampered by the users of a product, package, or system, or the users who can physically access it. It includes simple as well as complex devices. The complex device encrypts all the information between individual chips, or renders itself inoperable. Tamper resistance is generally used in packages in order to determine package or product tampering. Answer B is incorrect. Tamper evident specifies a process or device that makes unauthorized access to the protected object easily detected. Answer D is incorrect. Tamper proofing makes computers resistant to interference. Tamper proofing measures include automatic removal of sensitive information, automatic shutdown, and automatic physical locking. Answer C is incorrect. Tamper data is used to view and modify the HTTP or HTTPS headers and post parameters.

NEW QUESTION # 193
NIST SP 800-53A defines three types of interview depending on the level of assessment conducted. Which of the following NIST SP 800-53A interviews consists of informal and ad hoc interviews?

• A. Abbreviated
• B. Substantial
• C. Comprehensive
• D. Significant

Answer: A

Explanation:
Explanation/Reference:
Explanation: Abbreviated interview consists of informal and ad hoc interviews. AnswerD is incorrect.
Substantial interview consists of informal and structured interviews. AnswerA is incorrect. Comprehensive interview consists of formal and structured interviews. Answer: B is incorrect. There is no such type of interview in NIST SP 800-53A.

NEW QUESTION # 194
......

Full CSSLP Practice Test and 349 Unique Questions, Get it Now!: https://www.itpassleader.com/ISC/CSSLP-dumps-pass-exam.html

The Best CSSLP Exam Study Material Premium Files  and Preparation Tool: https://drive.google.com/open?id=1iTCVbsi9h9jLzZySuQWIvt-AgXiaRluQ