無料CISSP試験ブレーン問題集認定ガイド問題と解答
CISSP認定概要最新のCISSPPDF問題集
CISSP認定試験は、情報セキュリティに関連する幅広いトピックをカバーする包括的な試験です。この試験は、自己組織の情報資産のセキュリティに責任を持つプロフェッショナルの知識とスキルを試験するために設計されています。この試験は、250の多肢選択問題から構成され、受験者は6時間以内に試験を完了する必要があります。
ISC CISSP（認定情報システムセキュリティプロフェッショナル）試験は、情報セキュリティの専門家向けのグローバルに認知された認定です。サイバーセキュリティの分野で最も権威ある認定の一つと見なされています。試験は、セキュリティとリスク管理、資産セキュリティ、セキュリティエンジニアリング、通信とネットワークセキュリティ、アイデンティティとアクセス管理、セキュリティ評価とテスト、セキュリティオペレーション、ソフトウェア開発セキュリティなど、広範囲にわたるトピックをカバーしています。
質問 # 571
What IDS approach relies on a database of known attacks?
- A. Behavior-based intrusion detection
- B. Statistical anomaly-based intrusion detection
- C. Signature-based intrusion detection
- D. Network-based intrusion detection
正解：C
解説：
A weakness of the signature-based (or knowledge-based) intrusion detection approach is that only attack signatures that are stored in a database are detected. Network-based intrusion detection can either be signature-based or statistical anomaly-based (also called behavior-based). Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 2: Access control systems (page 49).
質問 # 572
Which of the following is an obvious disadvantage of deploying misuse detectors?
- A. They are costly to use.
- B. They are not accurate.
- C. They must be constantly updated with signatures of new attacks.
- D. They are costly to setup.
正解：C
解説：
Misuse detectors can only detect those attacks they know about - therefore they must be constantly updated with signatures of new attacks. Many misuse detectors are designed to use tightly defined signatures that prevent them from detecting variants of common attacks. State-based misuse detectors can overcome this limitation, but are not commonly used in commercial IDSs.
質問 # 573
Which of the following is the MOST secure firewall implementation?
- A. Packet-filtering firewalls
- B. Screened-subnet firewalls
- C. Dual-homed host firewalls
- D. Screened-host firewalls
正解：B
解説：
Explanation/Reference:
Explanation:
A screened-subnet architecture is the most secure solution as it adds another layer of security to the screened-host architecture, which in turn is more secure than both Dual-homed host firewalls and Packet- filtering firewalls.
Incorrect Answers:
A: Dual-homed host firewalls are less secure compared to screened-host firewall.
C: Screened-host firewalls are less secure compared to Screened-subnet firewalls, as the screened- subnet architecture is missing.
A screened host is a firewall that communicates directly with a perimeter router and the internal network.
D: A packet-filtering firewall is part of a screened-host firewall architecture, but is less secure as the screened-host firewall is missing.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 646
質問 # 574
What mechanism does a system use to compare the security labels of a subject and an object?
- A. Validation Module.
- B. Security Module.
- C. Clearance Check.
- D. Reference Monitor.
正解：D
解説：
Explanation/Reference:
Explanation:
The reference monitor is an abstract machine that mediates all access subjects have to objects, both to ensure that the subjects have the necessary access rights and to protect the objects from unauthorized access and destructive modification. For a system to achieve a higher level of trust, it must require subjects (programs, users, processes) to be fully authorized prior to accessing an object (file, program, resource). A subject must not be allowed to use a requested resource until the subject has proven it has been granted access privileges to use the requested object. The reference monitor is an access control concept, not an actual physical component, which is why it is normally referred to as the "reference monitor concept" or an "abstract machine."
Incorrect Answers:
A: A Validation Module is not what the system uses to compare the security labels of a subject and an object.
C: A Clearance Check is not what the system uses to compare the security labels of a subject and an object.
D: A Security Module is not what the system uses to compare the security labels of a subject and an object.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 362
質問 # 575
Which of the following are effective countermeasures against passive network-layer attacks?
- A. Encryption and security enabled applications
- B. Trusted software development and run time integrity controls
- C. Federated security and authenticated access controls
- D. Enclave boundary protection and computing environment defense
正解：A
解説：
Section: Software Development Security
質問 # 576
An incremental backup process
- A. Backs up all the data and changes the archive bit to 0.
- B. Backs up the files that been modified since the last full backup. It does not change the archive bit value.
- C. Backs up all the files that have changed since the last full or incremental backup and sets the archive bit to 0.
- D. Backs up all the data and changes the archive bit to 1.
正解：C
解説：
The following answers are incorrect:
"Backs up the files that been modified since the last full backup. It does not change the archive bit value." This is incorrect because this describes the differential backup process.
"Backs up all the data and changes the archive bit to 0." This is incorrect because this describes the full backup process.
Backs up all the data and changes the archive bit to 1. This is incorrect because this describes neither the full backup process, differential backup process, or the incremental backup process.
The following reference(s) were/was used to create this question:
All-in-One CISSP Exam Guide Fourth Edition by Shon Harris pages 801-802
質問 # 577
Which choice below is the BEST description of a Central Station Alarm
System?
- A. Rings an alarm in a central monitoring office of a third-party monitoring firm
- B. Rings an audible alarm on the local premises that it protects
- C. Rings an alarm in the office of the customer
- D. Also rings an alarm in the local fire or police station
正解：A
解説：
Answer "Rings an audible alarm on the local premises that it protects" describes a Local
Alarm System.
Answer "Rings an alarm in the office of the customer" describes a Proprietary System.
Answer "Also rings an alarm in the local fire or police station" describes an Auxiliary Station
System.
質問 # 578
What is the most secure way to dispose of information on a CD-ROM?
- A. Degaussing
- B. Physical destruction
- C. Sanitizing
- D. Physical damage
正解：B
解説：
Explanation/Reference:
Explanation:
The information stored on a CDROM is not in electro-magnetic format, so a degausser would be ineffective.
The only way to dispose of information on a CD-ROM is to physically destroy the CD-ROM.
Incorrect Answers:
A: You cannot sanitize read-only media such as a CDROM.
B: Physical damage is not the MOST secure way to dispose of information on a CD-ROM. Data could still be recovered from the undamaged part of the CD-ROM. Only complete destruction of the CD-ROM will suffice.
C: Degaussing does not work on read-only media such as a CDROM.
質問 # 579
Retaining system logs for six months or longer can be valuable for what activities?
- A. Physical and logical access control
- B. Disaster recovery and business continuity
- C. Forensics and incident response
- D. Identity and authorization management
正解：C
質問 # 580
The recommended optimal relative humidity range for computer operations is:
- A. 30% to 40%
- B. 60% to 80%
- C. 10% to 30%
- D. 40% to 60%
正解：D
解説：
The correct answer is C. 40% to 60% relative humidity is recommended
for safe computer operations. Too low humidity can create
static discharge problems, and too high humidity can create condensation and electrical contact problems.
質問 # 581
The Clark-Wilson Integrity Model (d. Clark, d. Wilson, A Comparison of Commercial and Military Computer Security Policies, Proceedings of the 1987 IEEE Computer Society Symposium on Research in Security and Privacy, Los Alamitos, CA, IEEE Computer Society Press, 1987) focuses on
what two concepts?
- A. Well-formed transactions and denial of service
- B. Separation of duty and well-formed transactions
- C. Least privilege and well-formed transactions
- D. Capability lists and domains
正解：B
解説：
The Clark-Wilson Model is a model focused on the needs of the commercial world and is based on the theory that integrity is more important than confidentiality for commercial organizations. Further, the model incorporates the commercial concepts of separation of duty and wellformed transactions. The well-formed transaction of the model is implemented by the transformation procedure (TP.)ATP is defined in the model as the mechanism for transforming the set of constrained data items (CDIs) from one valid state of integrity to another valid state of integrity. The Clark-Wilson Model defines rules for separation of duty that denote the relations between a user, TPs, and the CDIs that can be operated upon by those TPs. The model talks about the access triple that is the user, the program that is permitted to operate on the data, and the data. The other answers are distracters.
質問 # 582
Which of the following cannot be undertaken in conjunction or while computer incident handling is ongoing?
- A. System Imaging
- B. System development activity
- C. Help-desk function
- D. Risk management process
正解：B
解説：
Explanation/Reference:
Explanation:
The computer system should not be changed, while the incident handling is ongoing. System development should not occur during incident handling.
Incorrect Answers:
B: As part of the ongoing incident handling employees, vendors, customers, partner, devices or sensors report the event to Help Desk.
C: System imaging would not affect the ongoing incident handling and should take place to D: The Risk management process would not affect the ongoing incident handling.
References:
https://en.wikipedia.org/wiki/Computer_security_incident_management
質問 # 583
Which of the following represent the rows of the table in a relational database?
- A. attributes
- B. records or tuples
- C. relation
- D. record retention
正解：B
質問 # 584
In which order, from MOST to LEAST impacted, does user awareness training reduce the occurrence of the events below?
正解：
解説：
質問 # 585
Which of the following answer specifies the correct sequence of levels within the Capability Maturity Model (CMM)?
- A. Initial, Managed, Defined, optimized, Quantitatively managed
- B. Initial, Managed, Defined, Quantitatively managed, optimized
- C. Initial, Managed, Quantitatively managed, Defined, optimized
- D. Initial, Defined, Managed, Quantitatively managed, optimized
正解：B
解説：
Maturity model A maturity model can be viewed as a set of structured levels that describe how well the behaviors, practices and processes of an organization can reliably and sustainable produce required outcomes.
Image Source - http://www.cmmilevels.com/cmmi-levels.jpg
A maturity model can be used as a benchmark for comparison and as an aid to understanding - for
example, for comparative assessment of different organizations where there is something in
common that can be used as a basis for comparison. In the case of the CMM, for example, the
basis for comparison would be the organizations' software development processes.
Structure
The model involves five aspects:
Maturity Levels: a 5-level process maturity continuum - where the uppermost (5th) level is a
notional ideal state where processes would be systematically managed by a combination of
process optimization and continuous process improvement.
Key Process Areas: a Key Process Area identifies a cluster of related activities that, when
performed together, achieve a set of goals considered important.
Goals: the goals of a key process area summarize the states that must exist for that key process
area to have been implemented in an effective and lasting way. The extent to which the goals
have been accomplished is an indicator of how much capability the organization has established
at that maturity level. The goals signify the scope, boundaries, and intent of each key process
area.
Common Features: common features include practices that implement and institutionalize a key
process area. There are five types of common features: commitment to perform, ability to perform,
activities performed, measurement and analysis, and verifying implementation.
Key Practices: The key practices describe the elements of infrastructure and practice that
contribute most effectively to the implementation and institutionalization of the area.
Levels
There are five levels defined along the continuum of the model and, according to the SEI:
"Predictability, effectiveness, and control of an organization's software processes are believed to
improve as the organization moves up these five levels. While not rigorous, the empirical evidence
to date supports this belief".
Initial (chaotic, ad hoc, individual heroics) - the starting point for use of a new or undocumented
repeat process.
Repeatable - the process is at least documented sufficiently such that repeating the same steps
may be attempted.
Defined - the process is defined/confirmed as a standard business process, and decomposed to
levels 0, 1 and 2 (the last being Work Instructions).
Managed - the process is quantitatively managed in accordance with agreed-upon metrics.
Optimizing - process management includes deliberate process optimization/improvement.
Within each of these maturity levels are Key Process Areas which characteristic that level, and for
each such area there are five factors: goals, commitment, ability, measurement, and verification.
These are not necessarily unique to CMM, representing - as they do - the stages that
organizations must go through on the way to becoming mature.
The model provides a theoretical continuum along which process maturity can be developed
incrementally from one level to the next. Skipping levels is not allowed/feasible.
Level 1 - Initial (Chaotic)
It is characteristic of processes at this level that they are (typically) undocumented and in a state of
dynamic change, tending to be driven in an ad hoc, uncontrolled and reactive manner by users or
events. This provides a chaotic or unstable environment for the processes.
Level 2 - Repeatable
It is characteristic of processes at this level that some processes are repeatable, possibly with
consistent results. Process discipline is unlikely to be rigorous, but where it exists it may help to
ensure that existing processes are maintained during times of stress.
Level 3 - Defined
It is characteristic of processes at this level that there are sets of defined and documented
standard processes established and subject to some degree of improvement over time. These
standard processes are in place (i.e., they are the AS-IS processes) and used to establish
consistency of process performance across the organization.
Level 4 - Managed
It is characteristic of processes at this level that, using process metrics, management can
effectively control the AS-IS process (e.g., for software development ). In particular, management
can identify ways to adjust and adapt the process to particular projects without measurable losses
of quality or deviations from specifications. Process Capability is established from this level.
Level 5 - Optimizing
It is a characteristic of processes at this level that the focus is on continually improving process
performance through both incremental and innovative technological changes/improvements.
At maturity level 5, processes are concerned with addressing statistical common causes of
process variation and changing the process (for example, to shift the mean of the process
performance) to improve process performance. This would be done at the same time as
maintaining the likelihood of achieving the established quantitative process-improvement
objectives.
The following answers are incorrect:
The other option specified in the option does not provide correct sequence.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 188
CISSP Official study guide page number 693
Topic 5, Cryptography
質問 # 586
What can be defined as secret communications where the very existence of the message is hidden?
- A. Steganography
- B. Cryptology
- C. Clustering
- D. Vernam cipher
正解：A
解説：
Steganography is a secret communication where the very existence of the message is hidden. For example, in a digital image, the least significant bit of each word can be used to comprise a message without causing any significant change in the image. Key clustering is a situation in which a plaintext message generates identical ciphertext messages using the same transformation algorithm but with different keys. Cryptology encompasses cryptography and cryptanalysis. The Vernam Cipher, also called a one-time pad, is an encryption scheme using a random key of the same size as the message and is used only once. It is said to be unbreakable, even with infinite resources. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 4: Cryptography (page 134).
質問 # 587
Which of the following offers the BEST security functionality for transmitting authentication tokens?
- A. Security Assertion Markup Language (SAML)
- B. Remote Authentication Dial-In User Service (RADIUS)
- C. JavaScript Object Notation (JSON)
- D. Terminal Access Controller Access Control System (TACACS)
正解：A
解説：
Section: Mixed questions
質問 # 588
What is a Type 2 authentication factor?
- A. Something you know
- B. Something you are
- C. Something you have
正解：C
解説：
A Type 2 authentication factor is something you have, such as a smart card,
ATM card, token device, memory card, etc.
質問 # 589
What does a Synchronous (SYN) flood attack do?
- A. Exceeds the limits for new Transmission Control Protocol /Internet Protocol (TCP/IP) connections
- B. Empties the queue of pending Transmission Control Protocol /Internet Protocol (TCP/IP) requests
- C. Establishes many new Transmission Control Protocol / Internet Protocol (TCP/IP) connections
- D. Forces Transmission Control Protocol /Internet Protocol (TCP/IP) connections into a reset state
正解：C
解説：
Section: Communication and Network Security
質問 # 590
Due to system constraints, a group of system administrators must share a high-level access set of credentials.
Which of the following would be MOST appropriate to implement?
- A. Increased console lockout times for failed logon attempts
- B. Reduce the group in size
- C. Full logging on affected systems
- D. A credential check-out process for a per-use basis
正解：D
解説：
Explanation
Section: Security Operations
質問 # 591
Refer to the information below to answer the question.
During the investigation of a security incident, it is determined that an unauthorized individual accessed a system which hosts a database containing financial information.
If the intrusion causes the system processes to hang, which of the following has been affected?
- A. System auditability
- B. System confidentiality
- C. System availability
- D. System integrity
正解：C
質問 # 592
An organization regularly conducts its own penetration tests. Which of the following scenarios MUST be covered for the test to be effective?
- A. System administrator access compromised
- B. Internal user accidentally accessing data
- C. Internal attacker with access to the system
- D. Third-party vendor with access to the system
正解：C
解説：
Section: Software Development Security
質問 # 593
During a business impact analysis it is concluded that a system has maximum tolerable downtime of 2 hours. What would this system be classified as?
- A. Vital
- B. Urgent
- C. Critical
- D. Important
正解：C
解説：
Explanation/Reference:
Explanation:
A classification of critical has a maximum tolerable downtime (MTD) in minutes to hours, such as 2 hours.
Incorrect Answers:
A: A classification as Important would have a MTD of around 72 hours.
B: A classification as urgent would have a MTD of around 24 hours.
D: There is no MTD classification named vital. The classifications are Nonessential (30 days), Normal (7 days), Important (72 hours), Urgent (24 hours), and Critical/Essential (minutes to hours).
References:
http://docplayer.net/1184175-Cissp-common-body-of-knowledge-business-continuity-disaster-recovery- planning-domain-version-5-9-2.html
質問 # 594
Which choice below BEST describes the difference between the System
Owner and the Information Owner?
- A. One system could have multiple information owners.
- B. There is a one-to-one relationship between system owners and
information owners. - C. The System Owner is responsible for establishing the rules for
appropriate use of the information. - D. The Information Owner is responsible for defining the system's
operating parameters.
正解：A
解説：
The System Owner is responsible for ensuring that the security
plan is prepared and for implementing the plan and monitoring its
effectiveness. The System Owner is responsible for defining the system's operating parameters, authorized functions, and security requirements. The information owner for information stored within,
processed by, or transmitted by a system may or may not be the same
as the System Owner. Also, a single system may utilize information
from multiple Information Owners.
The Information Owner is responsible for establishing the rules for
appropriate use and protection of the subject data/information (rules of behavior). The Information Owner retains that responsibility even when the data/information are shared with other organizations.
Source: NIST Special Publication 800-18, Guide for Developing Security
Plans for Information Technology Systems.
質問 # 595
A customer continues to experience attacks on their email, web, and File Transfer Protocol (FTP) servers. These attacks are impacting their business operations. Which of the following is the BEST recommendation to make?
- A. Configure an intrusion detection system (IDS).
- B. Setup a network firewall.
- C. Create a demilitarized zone (DMZ).
- D. Deploy a bastion host.
正解：D
質問 # 596
......
ベストなISC CISSP学習ガイドと問題集には2023：https://www.jpntest.com/shiken/CISSP-mondaishu
トップクラスISC CISSP試験材料で学習ガイド！練習問題バージョンで挑もう：https://drive.google.com/open?id=1Ha-H_2D_moKLHfLxr7j9p9gn23e0FEIH