100%無料ISC Certification CSSLP問題集PDFお試しサンプル認定ガイドカバー率
PDF試験材料2024年最新の実際に出るCSSLP問題集
質問 # 114
FIPS 199 defines the three levels of potential impact on organizations: low, moderate, and high. Which of the following are the effects of loss of confidentiality, integrity, or availability in a high level potential impact?
- A. The loss of confidentiality, integrity, or availability might result in major financial losses.
- B. The loss of confidentiality, integrity, or availability might cause severe degradation in or loss of mission capability to an extent.
- C. The loss of confidentiality, integrity, or availability might result in a major damage to organizational assets.
- D. The loss of confidentiality, integrity, or availability might result in severe damages like life threatening injuries or loss of life.
正解：A、B、C、D
解説：
Explanation/Reference:
Explanation: The following are the effects of loss of confidentiality, integrity, or availability in a high level potential impact: It might cause a severe degradation in or loss of mission capability to an extent. It might result in a major damage to organizational assets. It might result in a major financial loss. It might result in severe harms such as serious life threatening injuries or loss of life.
質問 # 115
Which of the following DoD directives defines DITSCAP as the standard C&A process for the Department of Defense?
- A. DoD 5200.22-M
- B. DoD 8000.1
- C. DoD 5200.40
- D. DoD 8910.1
正解：C
解説：
Explanation/Reference:
Explanation: DITSCAP stands for DoD Information Technology Security Certification and Accreditation Process. The DoD Directive 5200.40 (DoD Information Technology Security Certification and Accreditation Process) established the DITSCAP as the standard C&A process for the Department of Defense. The Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) is a process defined by the United States Department of Defense (DoD) for managing risk. DIACAP replaced the former process, known as DITSCAP, in 2006. AnswerB is incorrect. This DoD Directive is known as National Industrial Security Program Operating Manual. AnswerC is incorrect. This DoD Directive is known as Defense Information Management (IM) Program. AnswerA is incorrect. This DoD Directive is known as Management and Control of Information Requirements.
質問 # 116
Which of the following are the important areas addressed by a software system's security policy? Each correct answer represents a complete solution. Choose all that apply.
- A. Data protection
- B. Identification and authentication
- C. Scalability
- D. Punctuality
- E. Accountability
- F. Access control
正解：A、B、E、F
解説：
Explanation/Reference:
Explanation: The security policy of a software system addresses the following important areas: Access control Data protection Confidentiality Integrity Identification and authentication Communication security Accountability AnswerE and B are incorrect. Scalability and punctuality are not addressed by a software system's security policy.
質問 # 117
Which of the following tiers addresses risks from an information system perspective?
- A. Tier 1
- B. Tier 0
- C. Tier 3
- D. Tier 2
正解：C
解説：
Explanation/Reference:
Explanation: The information system level is the tier 3. It addresses risks from an information system perspective, and is guided by the risk decisions at tiers 1 and 2. Risk decisions at tiers 1 and 2 impact the ultimate selection and deployment of requisite safeguards. This also has an impact on the countermeasures at the information system level. The RMF primarily operates at tier3 but it can also have interactions at tiers 1 and 2. AnswerA is incorrect. It is an invalid Tier description. Answer: D is incorrect.
The Organization Level is the Tier 1, and it addresses risks from an organizational perspective. AnswerC is incorrect. The mission and business process level is the Tier 2, and it addresses risks from the mission and business process perspective.
質問 # 118
Which of the following types of redundancy prevents attacks in which an attacker can get physical control of a machine, insert unauthorized software, and alter data?
- A. Data redundancy
- B. Hardware redundancy
- C. Application redundancy
- D. Process redundancy
正解：D
解説：
Process redundancy permits software to run simultaneously on multiple geographically distributed locations, with voting on results. It prevents attacks in which an attacker can get physical control of a machine, insert unauthorized software, and alter data.
質問 # 119
According to U.S. Department of Defense (DoD) Instruction 8500.2, there are eight Information Assurance (IA) areas, and the controls are referred to as IA controls. Which of the following are among the eight areas of IA defined by DoD? Each correct answer represents a complete solution. Choose all that apply.
- A. Information systems acquisition, development, and maintenance
- B. DC Security Design & Configuration
- C. EC Enclave and Computing Environment
- D. VI Vulnerability and Incident Management
正解：B、C、D
解説：
Explanation/Reference:
Explanation: According to U.S. Department of Defense (DoD) Instruction 8500.2, there are eight Information Assurance (IA) areas, and the controls are referred to as IA controls. Following are the various
U.S. Department of Defense information security standards: DC Security Design & Configuration IA Identification and Authentication EC Enclave and Computing Environment EB Enclave Boundary Defense PE Physical and Environmental PR Personnel CO Continuity VI Vulnerability and Incident Management
Answer B is incorrect. Business continuity management is an International information security standard.
質問 # 120
Which of the following programming languages are compiled into machine code and directly executed by the CPU of a computer system? Each correct answer represents a complete solution. Choose two.
- A. C++
- B. C
- C. Java EE
- D. Microosft.NET
正解：A、B
解説：
C and C++ programming languages are unmanaged code. Unmanaged code is compiled into machine code and directly executed by the CPU of a computer system. Answer C and B are incorrect. Java EE and Microsoft.Net are compiled into an intermediate code format.
質問 # 121
Which of the following is a signature-based intrusion detection system (IDS) ?
- A. Tripwire
- B. RealSecure
- C. StealthWatch
- D. Snort
正解：D
解説：
Explanation/Reference:
Explanation: Snort is a signature-based intrusion detection system. Snort is an open source network intrusion prevention and detection system that operates as a network sniffer. It logs activities of the network that is matched with the predefined signatures. Signatures can be designed for a wide range of traffic, including Internet Protocol (IP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Internet Control Message Protocol (ICMP). The three main modes in which Snort can be configured are as follows: Sniffer mode: It reads the packets of the network and displays them in a continuous stream on the console. Packet logger mode: It logs the packets to the disk. Network intrusion detection mode: It is the most complex and configurable configuration, allowing Snort to analyze network traffic for matches against a user-defined rule set. Answer: B is incorrect. StealthWatch is a behavior- based intrusion detection system. Answer: A is incorrect. RealSecure is a network-based IDS that monitors TCP, UDP and ICMP traffic and is configured to look for attack patterns. Answer: C is incorrect. Tripwire is a file integrity checker for UNIX/Linux that can be used for host-based intrusion detection.
質問 # 122
Which of the following techniques is used when a system performs the penetration testing with the objective of accessing unauthorized information residing inside a computer?
- A. Biometrician
- B. Port scanning
- C. Phreaking
- D. Van Eck Phreaking
正解：B
解説：
Port scanning identifies open doors to a computer. Hackers and crackers use this technique to obtain unauthorized information. Port scanning is the first basic step to get the details of open ports on the target system. Port scanning is used to find a hackable server with a hole or vulnerability. A port is a medium of communication between two computers. Every service on a host is identified by a unique 16-bit number called a port. A port scanner is a piece of software designed to search a network host for open ports. This is often used by administrators to check the security of their networks and by hackers to identify running services on a host with the view to compromising it. Port scanning is used to find the open ports, so that it is possible to search exploits related to that service and application. Answer D is incorrect. Phreaking is a process used to crack the phone system. The main aim of phreaking is to avoid paying for long- distance calls. As telephone networks have become computerized, phreaking has become closely linked with computer hacking. This is sometimes called the H/P culture (with H standing for Hacking and P standing for Phreaking). Answer A is incorrect. It is defined as a system using a physical attribute for authenticating. Only authorized users are provided access to network or application. Answer B is incorrect. It is described as a form of eavesdropping in which special equipments are used to pick up the telecommunication signals or data within a computer device.
質問 # 123
Single Loss Expectancy (SLE) represents an organization's loss from a single threat. Which of the following formulas best describes the Single Loss Expectancy (SLE)?
- A. SLE = Annualized Loss Expectancy (ALE) * Exposure Factor (EF)
- B. SLE = Annualized Loss Expectancy (ALE) * Annualized Rate of Occurrence (ARO)
- C. SLE = Asset Value (AV) * Exposure Factor (EF)
- D. SLE = Asset Value (AV) * Annualized Rate of Occurrence (ARO)
正解：C
解説：
Single Loss Expectancy is a term related to Risk Management and Risk Assessment. It can be defined as the monetary value expected from the occurrence of a risk on an asset. It is mathematically expressed as follows: Single Loss Expectancy (SLE) = Asset Value (AV) * Exposure Factor (EF) where the Exposure Factor is represented in the impact of the risk over the asset, or percentage of asset lost. As an example, if the Asset Value is reduced two thirds, the exposure factor value is .66. If the asset is completely lost, the Exposure Factor is 1.0. The result is a monetary value in the same unit as the Single Loss Expectancy is expressed. Answer C, D, and B are incorrect. These are not valid formulas of SLE.
質問 # 124
Which of the following processes describes the elements such as quantity, quality, coverage, timelines, and availability, and categorizes the different functions that the system will need to perform in order to gather the documented mission/business needs?
- A. Functional requirements
- B. Performance requirements
- C. Operational scenarios
- D. Human factors
正解：A
解説：
Explanation/Reference:
Explanation: The functional requirements categorize the different functions that the system will need to perform in order to gather the documented mission/business needs. The functional requirements describe the elements such as quantity, quality, coverage, timelines, and availability.
AnswerC is incorrect. The performance requirements comprise of speed, throughput, accuracy, humidity
tolerances, mechanical stresses such as vibrations or noises. AnswerA is incorrect. Human factor consists of factors, which affect the operation of the system or component, such as design space, eye movement, or ergonomics. AnswerD is incorrect. The operational scenarios provide assistance to the system designers and form the basis of major events in the acquisition phases, such as testing the products for system integration. The customer classifies and defines the operational scenarios, which indicate the range of anticipated uses of system products.
質問 # 125
Which of the following describes a residual risk as the risk remaining after a risk mitigation has occurred?
- A. ISSO
- B. DAA
- C. DIACAP
- D. SSAA
正解：C
解説：
Explanation/Reference:
Explanation: DIACAP describes a residual risk as the risk remaining after a risk mitigation has occurred.
The Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) is a process defined by the United States Department of Defense (DoD) for managing risk. DIACAP replaced the former process, known as DITSCAP (Department of Defense Information Technology Security Certification and Accreditation Process), in 2006. DoD Instruction (DoDI) 8510.01 establishes a standard DoD-wide process with a set of activities, general tasks, and a management structure to certify and accredit an Automated Information System (AIS) that will maintain the Information Assurance (IA) posture of the Defense Information Infrastructure (DII) throughout the system's life cycle.DIACAP applies to the acquisition, operation, and sustainment of any DoD system that collects, stores, transmits, or processes unclassified or classified information since December 1997. It identifies four phases: 1.System Definition
2.Verification 3.Validation 4.Re-Accreditation AnswerD is incorrect. An Information System Security Officer (ISSO) plays the role of a supporter. The responsibilities of an Information System Security Officer (ISSO) are as follows: Manages the security of the information system that is slated for Certification & Accreditation (C&A). Insures the information systems configuration with the agency's information security policy. Supports the information system owner/information owner for the completion of security-related responsibilities. Takes part in the formal configuration management process. Prepares Certification & Accreditation (C&A) packages. AnswerC is incorrect. The Designated Approving Authority (DAA), in the United States Department of Defense, is the official with the authority to formally assume responsibility for operating a system at an acceptable level of risk. The DAA is responsible for implementing system security. The DAA can grant the accreditation and can determine that the system's risks are not at an acceptable level and the system is not ready to be operational. AnswerB is incorrect. System Security Authorization Agreement (SSAA) is an information security document used in the United States Department of Defense (DoD) to describe and accredit networks and systems. The SSAA is part of the Department of Defense Information Technology Security Certification and Accreditation Process, or DITSCAP (superseded by DIACAP). The DoD instruction (issues in December 1997, that describes DITSCAP and provides an outline for the SSAA document is DODI 5200.40. The DITSCAP application manual (DoD 8510.1-M), published in July 2000, provides additional details.
質問 # 126
Which of the following configuration management system processes keeps track of the changes so that the latest acceptable configuration specifications are readily available?
- A. Configuration Status and Accounting
- B. Configuration Verification and Audit
- C. Configuration Control
- D. Configuration Identification
正解：A
解説：
Explanation/Reference:
Explanation: The configuration status accounting procedure is the ability to record and report on the configuration baselines associated with each configuration item at any moment of time. It supports the functional and physical attributes of software at various points in time, and performs systematic control of accounting to the identified attributes for the purpose of maintaining software integrity and traceability throughout the software development life cycle. The configuration status and accounting process keeps track of the changes so that the latest acceptable configuration specifications are readily available.
AnswerC is incorrect. The verification and audit processes seek to establish a high level of confidence in
how well the Configuration Management activity is working. AnswerA is incorrect. Configuration control is a procedure of the Configuration management. Configuration control is a set of processes and approval stages required to change a configuration item's attributes and to re-baseline them. It supports the change of the functional and physical attributes of software at various points in time, and performs systematic control of changes to the identified attributes. AnswerD is incorrect. Configuration identification is the process of identifying the attributes that define every aspect of a configuration item. A configuration item is a product (hardware and/or software) that has an end-user purpose. These attributes are recorded in configuration documentation and baselined. Baselining an attribute forces formal configuration change control processes to be effected in the event that these attributes are changed.
質問 # 127
Which of the following can be used to accomplish authentication? Each correct answer represents a complete solution. Choose all that apply.
- A. Encryption
- B. Biometrics
- C. Password
- D. Token
正解：B、C、D
解説：
The following can be used to accomplish authentication: 1.Password 2.Biometrics 3.Token A password is a secret word or string of characters that is used for authentication, to prove identity, or gain access to a resource.
質問 # 128
In which type of access control do user ID and password system come under?
- A. Power
- B. Technical
- C. Administrative
- D. Physical
正解：B
解説：
Technical access controls include IDS systems, encryption, network segmentation, and antivirus controls. Answer D is incorrect. The policies and procedures implemented by an organization come under administrative access controls. Answer A is incorrect. Security guards, locks on the gates, and alarms come under physical access controls. Answer C is incorrect. There is no such type of access control as power control.
質問 # 129
Which of the following are the basic characteristics of declarative security? Each correct answer represents a complete solution. Choose all that apply.
- A. It is a container-managed security.
- B. All security constraints are stated in the configuration files.
- C. The security policies are applied at the deployment time.
- D. It has a runtime environment.
正解：A、B、D
解説：
Explanation/Reference:
Explanation: The following are the basic characteristics of declarative security: In declarative security, programming is not required. All security constraints are stated in the configuration files. It is a container- managed security. The application server manages the enforcing process of security constraints. It has a runtime environment. The security policies for runtime environment are represented by the deployment descriptor. It can support different environments, such as development, testing, and production. AnswerD is incorrect. It is the characteristic of programmatic security.
質問 # 130
Which of the following software review processes increases the software security by removing the common vulnerabilities, such as format string exploits, race conditions, memory leaks, and buffer overflows?
- A. Management review
- B. Code review
- C. Peer review
- D. Software audit review
正解：B
解説：
Explanation/Reference:
Explanation: A code review is a systematic examination of computer source code, which searches and resolves issues occurred in the initial development phase. It increases the software security by removing common vulnerabilities, such as format string exploits, race conditions, memory leaks, and buffer overflows. A code review is performed in the following forms: Pair programming Informal walkthrough Formal inspection Answer: C is incorrect. A peer review is an examination process in which author and one or more colleagues examine a work product, such as document, code, etc., and evaluate technical content and quality. According to the Capability Maturity Model, peer review offers a systematic engineering practice in order to detect and resolve issues occurring in the software artifacts, and stops the leakage into field operations. Answer: A is incorrect. Management review is a management study into a project's status and allocation of resources. Answer: D is incorrect. In software audit review one or more auditors, who are not members of the software development organization, perform an independent examination of a software product, software process, or a set of software processes for assessing compliance with specifications, standards, contractual agreements, or other specifications.
質問 # 131
Which of the following test methods has the objective to test the IT system from the viewpoint of a threat- source and to identify potential failures in the IT system protection schemes?
- A. Automated vulnerability scanning tool
- B. On-site interviews
- C. Penetration testing
- D. Security Test and Evaluation (ST&E)
正解：C
解説：
Explanation/Reference:
Explanation: The goal of penetration testing is to examine the IT system from the perspective of a threat- source, and to identify potential failures in the IT system protection schemes. Penetration testing, when performed in the risk assessment process, is used to assess an IT system's capability to survive with the intended attempts to thwart system security. AnswerA is incorrect. The objective of ST&E is to ensure that the applied controls meet the approved security specification for the software and hardware and implement the organization's security policy or meet industry standards.
質問 # 132
......
更新されたのはISC CSSLP問題集PDFオンラインエンジン：https://www.jpntest.com/shiken/CSSLP-mondaishu
CSSLP.PDFで問題解答PDFサンプル問題信頼され続ける：https://drive.google.com/open?id=1kdxGhJAgVAv2H7I63cI7B_T8_ZiIY0Y5