67 free ISC2 CSSLP practice questions from the CertStash pack of 350, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 67 free here, all 350 in the pack, and each step includes the one before it.
Get all 350 questions (US$39) · Download the first 10 as a PDF
Question 1
Which of the following models uses a directed graph to specify the rights that a subject can transfer to an object or that a subject can take from another subject?
Show answer and explanation
Correct answer: A. Take-Grant Protection Model
The Take-Grant Protection Model uses a directed graph to represent the rights that subjects can transfer to objects or take from other subjects. It specifically models the dynamic nature of access rights through grant and take operations on a graph structure.
Why the other options are wrong
- B. The Biba Integrity Model focuses on preventing unauthorized modification and maintains integrity levels but does not use directed graphs to specify transferable rights.
- C. The Bell-LaPadula Model addresses confidentiality through security levels and does not specifically model the transfer of rights via directed graphs.
- D. The Access Matrix represents access rights in a table format, not a directed graph structure.
Question 2
You are the project manager for GHY Project and are working to create a risk response for a negative risk. You and the project team have identified the risk that the project may not complete on time, as required by the management, due to the creation of the user guide for the software you're creating. You have elected to hire an external writer in order to satisfy the requirements and to alleviate the risk event. What type of risk response have you elected to use in this instance?
Show answer and explanation
Correct answer: A. Transference
Transference (or mitigation through outsourcing) involves shifting the risk to a third party who is better equipped to handle it. By hiring an external writer to complete the user guide, the project transfers the schedule risk associated with user guide creation to the external vendor.
Why the other options are wrong
- B. Exploiting is a strategy used for positive risks to enhance opportunities, not for negative risks like schedule delays.
- C. Avoidance eliminates the risk entirely, which is not applicable here since the user guide must still be created.
- D. Sharing applies to distributing risk responsibility among parties, not specifically transferring it to an external resource for handling.
Question 3
Which of the following types of redundancy prevents attacks in which an attacker can get physical control of a machine, insert unauthorized software, and alter data?
Show answer and explanation
Correct answer: C. Process redundancy
Process redundancy prevents attacks where an attacker gains physical control of a machine and inserts unauthorized software or alters data by maintaining independent parallel processes that can detect and prevent such tampering. Process redundancy includes checkpoints and verification that ensure malicious modifications are detected.
Why the other options are wrong
- A. Data redundancy creates backup copies but does not specifically prevent physical attacks or unauthorized software insertion.
- B. Hardware redundancy provides failover capabilities but does not specifically defend against physical tampering or software insertion attacks.
- D. Application redundancy provides alternative applications but does not inherently prevent physical attacks or unauthorized software insertion.
Question 4
Which of the following individuals inspects whether the security policies, standards, guidelines, and procedures are efficiently performed in accordance with the company's stated security objectives?
Show answer and explanation
Correct answer: D. Information system auditor
An Information System Auditor inspects and verifies whether security policies, standards, guidelines, and procedures are efficiently performed in accordance with the company's stated security objectives. This is the core responsibility of the audit function.
Why the other options are wrong
- A. An Information System Security Professional implements and manages security measures but does not specifically conduct independent audits of policy compliance.
- B. A Data Owner is responsible for the sensitivity and criticality of data but does not conduct system-wide security audits.
- C. Senior Management sets security objectives but does not typically perform the detailed inspection and auditing activities.
Question 5
Which of the following process areas does the SSE-CMM define in the 'Project and Organizational Practices' category? Each correct answer represents a complete solution. Choose all that apply.
Show answer and explanation
Correct answer: A, C, D. Provide Ongoing Skills and Knowledge; Manage Project Risk; Improve Organization's System Engineering Process
The Systems Security Engineering Capability Maturity Model (SSE-CMM) defines Provide Ongoing Skills and Knowledge, Manage Project Risk, and Improve Organization's System Engineering Process as process areas within the Project and Organizational Practices category. These address organizational capability and project management aspects of security engineering.
Why the other options are wrong
- B. Verify and Validate Security is a process area in the Technical Practices category, not the Project and Organizational Practices category.
Question 6
The LeGrand Vulnerability-Oriented Risk Management method is based on vulnerability analysis and consists of four principle steps. Which of the following processes does the risk assessment step include? Each correct answer represents a part of the solution. Choose all that apply.
Show answer and explanation
Correct answer: B, C, D. Cost-benefit examination of countermeasures; Identification of vulnerabilities; Assessment of attacks
The risk assessment step within the LeGrand Vulnerability-Oriented Risk Management method encompasses identifying vulnerabilities, assessing potential attacks that could exploit those vulnerabilities, and examining the cost-benefit analysis of implementing countermeasures to address them. Remediation itself is a separate implementation step that follows the assessment phase, not part of the assessment process itself.
Why the other options are wrong
- A. Remediation is an implementation step that occurs after risk assessment is complete, not part of the assessment process.
Question 7
You work as a Security Manager for Tech Perfect Inc. You have set up a SIEM server for the following purposes: Analyze the data from different log sources Correlate the events among the log entries Identify and prioritize significant events Initiate responses to events if required One of your log monitoring staff wants to know the features of SIEM product that will help them in these purposes. What features will you recommend? Each correct answer represents a complete solution. Choose all that apply.
Show answer and explanation
Correct answer: A, C, D, E. Asset information storage and correlation; Incident tracking and reporting; Security knowledge base; Graphical user interface
A SIEM system requires asset information storage and correlation to track systems, incident tracking and reporting to document responses, a security knowledge base to inform decision-making, and a graphical user interface to present data effectively to analysts. Transmission confidentiality protection, while important for SIEM infrastructure security, is not a feature of the SIEM product itself for analyzing and responding to events.
Why the other options are wrong
- B. Transmission confidentiality protection is a network security measure rather than a feature of the SIEM product for event analysis and response.
Question 8
Which of the following methods offers a number of modeling practices and disciplines that contribute to a successful service-oriented life cycle management and modeling?
Show answer and explanation
Correct answer: A. Service-oriented modeling framework (SOMF)
The Service-Oriented Modeling Framework (SOMF) is specifically designed to provide modeling practices and disciplines that support successful service-oriented life cycle management. It offers structured approaches to designing, analyzing, and implementing service-oriented architectures throughout the entire system development and management lifecycle.
Why the other options are wrong
- B. SOA is an architectural approach but not a modeling framework with specific disciplines for life cycle management.
- C. SABSA is a security-focused architecture framework, not primarily focused on service-oriented life cycle modeling practices.
- D. SOMA is a methodology for service-oriented modeling but is less comprehensive as a framework for complete life cycle management than SOMF.
Question 9
Which of the following are the goals of risk management? Each correct answer represents a complete solution. Choose three.
Show answer and explanation
Correct answer: A, B, D. Identifying the risk; Assessing the impact of potential threats; Finding an economic balance between the impact of the risk and the cost of the countermeasure
The goals of risk management include identifying risks to understand what threats exist, assessing the impact of potential threats to determine severity and consequences, and finding an economic balance between risk impact and countermeasure cost to allocate resources effectively. These three elements form the foundation of sound risk management strategy.
Why the other options are wrong
- C. Identifying the accused is a law enforcement or investigative function unrelated to risk management objectives.
Question 10
Which of the following attacks causes software to fail and prevents the intended users from accessing software?
Show answer and explanation
Correct answer: C. Sabotage attack
A sabotage attack specifically targets system availability by intentionally causing software to fail and preventing authorized users from accessing it. This distinguishes it from reconnaissance (information gathering), enabling (facilitating unauthorized access), and disclosure (exposing confidential information) attacks, which have different primary objectives.
Why the other options are wrong
- A. Enabling attacks facilitate unauthorized access but do not necessarily prevent legitimate users from accessing systems.
- B. Reconnaissance attacks gather information about systems but do not cause service failures.
- D. Disclosure attacks aim to expose confidential information rather than cause system unavailability.
What people say about the full CSSLP pack 5.0 from 6
After my experience with the CSSLP exam, I can now understand why my colleagues were suggesting me Cert Stash and giving 100% passing surety. Their content is so helpful I got 89% in my CSSLP exam. Thanks, Cert Stash!
CSSLP exams were coming up and I was so worried. I had no idea how I was going to pass. But then, I found Cert Stash. The material on their site was so well done that I had no trouble passing the exam! Thank you, Cert Stash, for all your help!
100% recommend for CSSLP prep.
Question 11
Which of the following provides an easy way to programmers for writing lower-risk applications and retrofitting security into an existing application?
Show answer and explanation
Correct answer: B. ESAPI
ESAPI (Enterprise Security API) is a free, open-source web application security control library designed to help programmers write lower-risk applications and retrofit security into existing applications. It provides pre-built security controls and best practices that developers can integrate without building security mechanisms from scratch.
Why the other options are wrong
- A. Watermarking is used for copyright protection and digital rights management, not application security.
- C. Encryption wrapper provides encryption capabilities but does not offer the comprehensive security framework that ESAPI provides.
- D. Code obfuscation obscures code to prevent reverse engineering but does not provide security controls for preventing vulnerabilities.
Question 12
Which of the following technologies is used by hardware manufacturers, publishers, copyright holders and individuals to impose limitations on the usage of digital content and devices?
Show answer and explanation
Correct answer: D. Digital rights management
Digital Rights Management (DRM) is a technology used by hardware manufacturers, publishers, copyright holders, and individuals to impose restrictions and limitations on the usage, copying, modification, and distribution of digital content and devices. DRM enforces licensing agreements and protects intellectual property.
Why the other options are wrong
- A. A hypervisor is a virtualization technology for running multiple operating systems, not for restricting digital content usage.
- B. Grid computing is a distributed computing architecture for processing large computational tasks, not for managing digital rights.
- C. Code signing is a cryptographic technique to verify software authenticity and integrity, not primarily for imposing usage limitations on digital content.
Question 13
You are advising a school district on disaster recovery plans. In case a disaster affects the main IT centers for the district they will need to be able to work from an alternate location. However, budget is an issue. Which of the following is most appropriate for this client?
Show answer and explanation
Correct answer: C. Warm site
A warm site is the most appropriate option for a budget-conscious school district. It maintains equipment and data that is partially prepared but not fully operational, requiring activation and configuration before use. This provides a balance between cost-effectiveness and recovery capability, falling between the expense of a hot site and the lengthy recovery time of a cold site.
Why the other options are wrong
- A. A cold site is the least expensive option but requires significant time to activate and configure, which may be too slow for critical operations.
- B. Off site refers to a general location but does not specify the level of preparedness or operational status of the facility.
- D. A hot site is fully operational and immediately available but represents the highest cost option, which conflicts with the stated budget constraints.
Question 14
NIST SP 800-53A defines three types of interview depending on the level of assessment conducted. Which of the following NIST SP 800-53A interviews consists of informal and ad hoc interviews?
Show answer and explanation
Correct answer: C. Abbreviated
The Abbreviated assessment level in NIST SP 800-53A consists of informal and ad hoc interviews conducted with minimal structure. Abbreviated assessments are the least rigorous assessment type and use conversational interviews to gather information efficiently for lower-impact systems.
Why the other options are wrong
- A. Comprehensive assessments use formal, structured interviews and detailed documentation review.
- B. Significant assessments employ more formal interview processes than abbreviated assessments.
- D. Substantial assessments are more thorough and structured than abbreviated assessments.
Question 15
In which of the following architecture styles does a device receive input from connectors and generate transformed outputs?
Show answer and explanation
Correct answer: C. Pipes and filters
The pipes and filters architecture style is specifically designed around components that receive input from connectors (pipes), perform a transformation or processing operation, and generate transformed outputs. Each filter is independent and communicates through well-defined data channels, making this the defining characteristic of the pipes and filters pattern. N-tiered, heterogeneous, and layered architectures have different organizational structures not centered on this input-transform-output model.
Why the other options are wrong
- A. N-tiered architecture organizes components into horizontal layers of functionality, not around input-output transformations.
- B. Heterogeneous architecture combines different technologies and types of components, not specifically input-transform-output flows.
- D. Layered architecture separates concerns vertically but does not define the pipes and filters transformation pattern.
Question 16
Which of the following secure coding principles and practices defines the appearance of code listing so that a code reviewer and maintainer who have not written that code can easily understand it?
Show answer and explanation
Correct answer: C. Use a consistent coding style
Using a consistent coding style is the secure coding principle that defines the appearance of code listing so that reviewers and maintainers unfamiliar with the code can easily understand it. Consistent style includes naming conventions, indentation, formatting, and structure that make code readable and maintainable by others.
Why the other options are wrong
- A. Making code forward and backward traceable relates to traceability and change tracking, not code appearance and readability.
- B. Reviewing code during and after coding is a quality assurance process that does not specifically define code appearance.
- D. Keeping code simple and small addresses complexity reduction but does not specifically govern code appearance and style conventions.
Question 17
Which of the following are the common roles with regard to data in an information classification program? Each correct answer represents a complete solution. Choose all that apply.
Show answer and explanation
Correct answer: B, C, D, E. Custodian; Owner; User; Security auditor
In information classification programs, the common roles are Custodian (responsible for protecting and maintaining data), Owner (accountable for the data and determines classification levels), User (accesses and uses the data according to policy), and Security Auditor (verifies compliance with classification policies). These roles share responsibility for proper data handling and classification implementation.
Why the other options are wrong
- A. Editor is not a standard role in data classification programs; editing is a function performed by users or custodians within their authorized scope.
Question 18
Which of the following testing methods verifies the interfaces between components against a software design?
Show answer and explanation
Correct answer: B. Integration testing
Integration testing is the testing method that verifies the interfaces between components against a software design. It focuses on how different modules or components interact with each other and ensures that the interfaces between them function correctly according to the design specifications. This distinguishes it from unit testing (individual components) and regression testing (ensuring changes don't break existing functionality).
Why the other options are wrong
- A. Regression testing verifies that changes to code do not introduce new defects in existing functionality, not specifically component interfaces.
- C. Black-box testing examines functionality without knowledge of internal structure and does not specifically focus on component interface verification.
- D. Unit testing verifies individual components in isolation, not the interfaces between components.
Question 19
In which of the following types of tests are the disaster recovery checklists distributed to the members of disaster recovery team and asked to review the assigned checklist?
Show answer and explanation
Correct answer: D. Checklist test
A checklist test is the type of disaster recovery test where disaster recovery checklists are distributed to team members for review of their assigned sections. This test requires minimal effort and is used to verify that team members understand their responsibilities and that procedures remain current and valid.
Why the other options are wrong
- A. A parallel test involves running the actual system alongside the recovery system, not just reviewing checklists.
- B. A simulation test involves role-playing and simulating recovery procedures without using actual systems or data.
- C. A full-interruption test actually shuts down the production system and tests full recovery, rather than simply reviewing checklists.
Question 20
Which of the following software review processes increases the software security by removing the common vulnerabilities, such as format string exploits, race conditions, memory leaks, and buffer overflows?
Show answer and explanation
Correct answer: B. Code review
Code review is the software review process that increases security by identifying and removing common vulnerabilities such as format string exploits, race conditions, memory leaks, and buffer overflows. Code review involves detailed examination of source code to detect coding flaws and security weaknesses before deployment.
Why the other options are wrong
- A. Management review focuses on organizational and process-level issues, not on identifying specific code vulnerabilities.
- C. Peer review is a general quality assurance mechanism but code review specifically targets security vulnerabilities in source code.
- D. Software audit review examines compliance with standards and procedures rather than identifying specific coding vulnerabilities.
Question 21
The NIST Information Security and Privacy Advisory Board (ISPAB) paper "Perspectives on Cloud Computing and Standards" specifies potential advantages and disdvantages of virtualization. Which of the following disadvantages does it include? Each correct answer represents a complete solution. Choose all that apply.
Show answer and explanation
Correct answer: C, D, E, F, G. It initiates the risk that malicious software is targeting the VM environment; It increases overall security risk shared resources; It creates the possibility that remote attestation may not work; It involves new protection mechanisms for preventing VM escape, VM detection, and VM-VM interference; It increases configuration effort because of complexity and composite system.
The NIST ISPAB paper identifies several disadvantages of virtualization including: the risk of malicious software targeting the VM environment (C), increased security risk from shared resources (D), the possibility that remote attestation may not work due to VM abstraction (E), the need for new protection mechanisms against VM escape and VM-VM interference (F), and increased configuration effort due to complexity (G). Options A and B are actually advantages, rollback/snapshot features increase fault tolerance, and introspection capabilities enhance intrusion detection, so these are not disadvantages.
Why the other options are wrong
- A. Rollback and snapshot features are advantages that increase fault tolerance, not disadvantages.
- B. Enhanced intrusion detection through introspection is an advantage, not a disadvantage.
Question 22
What are the security advantages of virtualization, as described in the NIST Information Security and Privacy Advisory Board (ISPAB) paper "Perspectives on Cloud Computing and Standards"? Each correct answer represents a complete solution. Choose three.
Show answer and explanation
Correct answer: B, C, D. It adds a layer of security for defense-in-depth; It decreases exposure of weak software; It decreases configuration effort.
Virtualization provides a layer of security for defense-in-depth by isolating systems, decreases exposure of weak software through segmentation and containment, and decreases configuration effort by enabling standardized virtual machine templates and deployment automation. These benefits align with the NIST ISPAB perspectives on cloud computing security.
Why the other options are wrong
- A. While virtualization can support fault tolerance through redundancy, this is an availability advantage rather than a primary security advantage.
Question 23
Which of the following security design patterns provides an alternative by requiring that a user's authentication credentials be verified by the database before providing access to that user's data?
Show answer and explanation
Correct answer: C. Password propagation
Password propagation is the security design pattern where user authentication credentials are verified by the database before access to the user's data is granted, rather than propagating passwords across multiple systems or using other authentication mechanisms.
Why the other options are wrong
- A. Secure assertion involves cryptographic verification of claims rather than direct credential verification by the database.
- B. Authenticated session uses session tokens after initial authentication rather than verifying credentials directly at the database layer.
- D. Account lockout is a response mechanism to failed authentication attempts, not a design pattern for credential verification.
Question 24
In which of the following testing methodologies do assessors use all available documentation and work under no constraints, and attempt to circumvent the security features of an information system?
Show answer and explanation
Correct answer: B. Penetration test
A penetration test is a security testing methodology where assessors use all available documentation and work with minimal constraints to attempt to circumvent security features of an information system. Full operational tests are broader system tests, paper tests are theoretical reviews without hands-on attempts, and walk-through tests involve guided reviews with system administrators. Penetration testing specifically involves active attempts to break through security controls under authorized conditions.
Why the other options are wrong
- A. Full operational tests assess entire system functionality rather than specifically attempting to circumvent security features.
- C. Paper tests are theoretical assessments based on documentation review without attempting actual system compromise.
- D. Walk-through tests involve guided reviews with cooperation of system staff, not independent attempts to circumvent security.
Question 25
Which of the following authentication methods is used to access public areas of a Web site?
Show answer and explanation
Correct answer: A. Anonymous authentication
Anonymous authentication is the method used to access public areas of a website where no credentials or identification are required. Visitors can browse public content without providing any authentication information, making this the standard approach for unrestricted web access.
Why the other options are wrong
- B. Biometrics authentication requires biological data and is not used for public website access; it is employed for high-security applications.
- C. Mutual authentication involves verification between both client and server and is not the standard method for public website areas.
- D. Multi-factor authentication requires multiple verification methods and is not appropriate for unrestricted public access to websites.
Question 26
Which of the following methods determines the principle name of the current user and returns the jav a.security.Principal object in the HttpServletRequest interface?
Show answer and explanation
Correct answer: A. getUserPrincipal()
The getUserPrincipal() method of the HttpServletRequest interface returns the principal name of the current user as a java.security.Principal object. This method identifies the authenticated user making the request. The isUserInRole() method checks if a user belongs to a role, getRemoteUser() returns the username as a string, and getCallerPrincipal() is used in EJB contexts, not HttpServletRequest.
Why the other options are wrong
- B. isUserInRole() checks whether the user belongs to a specific role, not returning the principal object.
- C. getRemoteUser() returns the username as a string, not the java.security.Principal object.
- D. getCallerPrincipal() is an EJB method, not part of the HttpServletRequest interface.
Question 27
Which of the following statements is true about residual risks?
Show answer and explanation
Correct answer: A. It is the probabilistic risk after implementing all security measures.
Residual risk is the probabilistic risk that remains after implementing all security measures and risk responses. It acknowledges that even with comprehensive controls in place, some level of risk persists. This reflects the reality that no security posture can achieve zero risk.
Why the other options are wrong
- B. This describes threat-vulnerability pairing, which is relevant to risk identification but not the definition of residual risk
- C. This defines a vulnerability itself, not residual risk
- D. This describes inherent risk or initial risk before controls, which is the opposite of residual risk
Question 28
Which of the following statements are true about declarative security? Each correct answer represents a complete solution. Choose all that apply.
Show answer and explanation
Correct answer: A, B. It is employed in a layer that relies outside of the software code or uses attributes of the code; It applies the security policies on the software applications at their runtime.
Declarative security operates through metadata, attributes, and configuration settings that exist outside the core application code, allowing security policies to be applied at runtime without embedding security logic directly in the code. This approach enforces security decisions based on these explicit declarations and attributes, enabling centralized policy management and separation of security concerns from business logic. Security decisions in declarative security are based on explicit statements and attributes set by administrators, not derived from business logic, and the security policies are applied by the runtime environment rather than being determined by the code itself.
Why the other options are wrong
- C. Authentication decisions in declarative security are based on explicit security policies and attributes, not on business logic.
- D. While declarative security does use explicit statements, this is only half the definition; option A more completely describes the nature of declarative security by explaining the layer outside code.
Question 29
To help review or design security controls, they can be classified by several criteria . One of these criteria is based on their nature. According to this criterion, which of the following controls consists of incident response processes, management oversight, security awareness, and training?
Show answer and explanation
Correct answer: C. Procedural control
Procedural controls consist of administrative and process-oriented safeguards including incident response processes, management oversight, security awareness, and training. These controls rely on defined procedures and human execution rather than physical barriers or technical mechanisms.
Why the other options are wrong
- A. Compliance controls ensure adherence to regulations and standards, not specifically incident response and training
- B. Physical controls involve tangible barriers and access restrictions like locks and surveillance
- D. Technical controls use technology and systems such as firewalls, encryption, and authentication mechanisms
Question 30
Companies use some special marks to distinguish their products from those of other companies. These marks can include words, letters, numbers, drawings, etc. Which of the following terms describes these special marks?
Show answer and explanation
Correct answer: B. Trademark
A trademark is a special mark used to distinguish one company's products from those of competitors. Trademarks can consist of words, letters, numbers, symbols, drawings, or combinations thereof, and they serve as legal protection for brand identity and product differentiation in commerce.
Why the other options are wrong
- A. Business mark is not a standardized legal term for product distinction.
- C. Sales mark is not the correct term for distinguishing product ownership or origin.
- D. Product mark is too vague and not the formal legal designation used in intellectual property law.
Question 31
Which of the following terms ensures that no intentional or unintentional unauthorized modification is made to data?
Show answer and explanation
Correct answer: B. Integrity
Integrity is the security principle that ensures data has not been intentionally or unintentionally modified, altered, or corrupted. It guarantees that information remains accurate, complete, and unchanged from its original state unless authorized modifications occur. This is fundamental to data trustworthiness and is typically protected through checksums, digital signatures, and access controls.
Why the other options are wrong
- A. Non-repudiation ensures a party cannot deny performing an action, not preventing data modification.
- C. Authentication verifies identity of users or systems, not the state of data itself.
- D. Confidentiality protects data from unauthorized disclosure or viewing, not from modification.
Question 32
The Data and Analysis Center for Software (DACS) specifies three general principles for software assurance which work as a framework in order to categorize various secure design principles. Which of the following principles and practices does the General Principle 1 include? Each correct answer represents a complete solution. Choose two.
Show answer and explanation
Correct answer: A, D. Principle of separation of privileges, duties, and roles; Principle of least privilege
The DACS General Principle 1 focuses on foundational design principles including the Principle of Least Privilege and the Principle of Separation of Privileges, Duties, and Roles. These principles establish the core access control and privilege management framework. Options B and C relate to different DACS principles that address trust assumptions and design simplification separately.
Why the other options are wrong
- B. Assuming environment data is not trustworthy relates to DACS Principle 2 concerning trust boundaries rather than Principle 1.
- C. Simplify the design is a separate DACS principle, not part of Principle 1's focus on privilege and duty separation.
Question 33
Which of the following strategies is used to minimize the effects of a disruptive event on a company, and is created to prevent interruptions to normal business activity?
Show answer and explanation
Correct answer: D. Business Continuity Plan
A Business Continuity Plan (BCP) is the comprehensive strategy designed to minimize the effects of disruptive events on a company and prevent interruptions to normal business activity. It encompasses preparation, response, and recovery measures to maintain critical business functions during and after a disruption.
Why the other options are wrong
- A. A Continuity of Operations Plan focuses specifically on government operations and maintaining essential functions during emergencies, rather than general business continuity.
- B. A Contingency Plan addresses specific scenarios and backup procedures but is narrower in scope than a comprehensive business continuity plan.
- C. A Disaster Recovery Plan focuses on recovery after a disaster has occurred, whereas a Business Continuity Plan emphasizes prevention and minimization of disruption.
Question 34
What are the various phases of the Software Assurance Acquisition process according to the U.S. Department of Defense (DoD) and Department of Homeland Security (DHS) Acquisition and Outsourcing Working Group?
Show answer and explanation
Correct answer: C. Planning, contracting, monitoring and acceptance, follow-on
According to the U.S. Department of Defense and Department of Homeland Security Acquisition and Outsourcing Working Group, the Software Assurance Acquisition process consists of four phases: Planning, Contracting, Monitoring and Acceptance, and Follow-on. This structured approach ensures software security is addressed throughout the acquisition lifecycle.
Why the other options are wrong
- A. This sequence omits the planning phase, which is foundational to the DoD/DHS process.
- B. This arrangement does not match the official DoD/DHS phases and sequence.
- D. Designing is not a formal phase in the DoD/DHS Software Assurance Acquisition process; the phases begin with Planning.
Question 35
You are the project manager of the CUL project in your organization. You and the project team are assessing the risk events and creating a probability and impact matrix for the identified risks. Which one of the following statements best describes the requirements for the data type used in qualitative risk analysis?
Show answer and explanation
Correct answer: C. A qualitative risk analysis requires accurate and unbiased data if it is to be credible.
Qualitative risk analysis credibility depends on accurate and unbiased data provided by stakeholders. The analysis uses subjective judgment to assess probability and impact, but this judgment must be grounded in factual, unbiased information to produce meaningful results. Biased data or tolerances would compromise the analysis validity. The process does not require speed over accuracy, nor does it intentionally incorporate bias.
Why the other options are wrong
- A. Qualitative risk analysis requires unbiased data, not biased data, to maintain credibility.
- B. While stakeholders should be unbiased, requiring them to be biased in their risk tolerances contradicts proper analysis methodology.
- D. Analysis quality is more important than speed; fast and simple data without accuracy undermines the entire assessment.
Question 36
In which of the following alternative processing sites is the backup facility maintained in a constant order, with a full complement of servers, workstations, and communication links ready to assume the primary operations responsibility?
Show answer and explanation
Correct answer: B. Hot Site
A hot site is a fully operational backup facility maintained in a constant state of readiness with a complete complement of servers, workstations, network equipment, and communication links. It can assume primary operations responsibility immediately with minimal downtime, making it the most expensive but most reliable alternative processing site option.
Why the other options are wrong
- A. A cold site is an empty facility with basic infrastructure but no equipment or data, requiring significant time to become operational.
- C. A warm site has some equipment and data but is not fully operational, requiring activation and configuration before it can assume primary operations.
- D. A mobile site is a portable facility that can be deployed to different locations, not a permanently maintained facility in constant readiness.
Question 37
The organization level is the Tier 1 and it addresses risks from an organizational perspective. What are the various Tier 1 activities? Each correct answer represents a complete solution. Choose all that apply.
Show answer and explanation
Correct answer: A, B, C. The organization plans to use the degree and type of oversight, to ensure that the risk management strategy is being effectively carried out; The level of risk tolerance; The techniques and methodologies an organization plans to employ, to evaluate information system-related security risks.
Tier 1 of the Risk Management Framework operates at the organizational level and encompasses strategic risk management activities. These include planning oversight and monitoring of the risk management strategy (A), establishing organizational risk tolerance and appetite (B), and selecting the techniques and methodologies for evaluating security risks (C). These activities establish the foundation for risk management across the organization.
Why the other options are wrong
- D. The RMF operates across all tiers, with Tier 1 being organizational, Tier 2 being mission/business process, and Tier 3 being information system levels; it is not primarily limited to Tier 1.
Question 38
Which of the following cryptographic system services ensures that information will not be disclosed to any unauthorized person on a local network?
Show answer and explanation
Correct answer: D. Confidentiality
Confidentiality is the cryptographic service that ensures information will not be disclosed to unauthorized persons. Encryption and confidentiality controls prevent eavesdropping and unauthorized access to data on local networks. Authentication verifies identity, integrity ensures data is unmodified, and non-repudiation prevents denial of actions, none of these directly protect against unauthorized disclosure.
Why the other options are wrong
- A. Authentication verifies identity but does not prevent unauthorized disclosure of information.
- B. Integrity ensures data is not modified but does not prevent disclosure to unauthorized parties.
- C. Non-repudiation prevents denial of actions but does not prevent unauthorized access to information.
Question 39
The Information System Security Officer (ISSO) and Information System Security Engineer (ISSE) play the role of a supporter and advisor, respectively. Which of the following statements are true about ISSO and ISSE? Each correct answer represents a complete solution. Choose all that apply.
Show answer and explanation
Correct answer: B, C, D. An ISSE provides advice on the continuous monitoring of the information system; An ISSO manages the security of the information system that is slated for Certification & Accreditation (C&A); An ISSE provides advice on the impacts of system changes.
The ISSE provides technical advice on continuous monitoring, system changes, and security implementation, serving as the primary advisor on security engineering matters. The ISSO manages the security of information systems slated for Certification & Accreditation. The ISSE supports through engineering advice rather than direct management of C&A systems, and the ISSO does not take direct part in development activities.
Why the other options are wrong
- A. The ISSE provides advisory and engineering guidance; it is the ISSO who manages the security of the system slated for C&A.
- E. The ISSO participates in oversight and management of development activities rather than taking part in development activities themselves.
Question 40
Which of the following is a set of exclusive rights granted by a state to an inventor or his assignee for a fixed period of time in exchange for the disclosure of an invention?
Show answer and explanation
Correct answer: D. Patent
A patent is a set of exclusive rights granted by a state to an inventor or assignee for a fixed period in exchange for public disclosure of the invention. Patents protect novel inventions including processes, algorithms, devices, and technical methods.
Why the other options are wrong
- A. Copyright protects original works of authorship like written content and code expression, not inventive processes or algorithms.
- B. Snooping refers to unauthorized surveillance or eavesdropping, not an intellectual property protection mechanism.
- C. A utility model is a lesser form of patent protection available in some countries, but the term 'patent' is the primary and comprehensive answer.
Question 41
Which of the following are the levels of public or commercial data classification system? Each correct answer represents a complete solution. Choose all that apply.
Show answer and explanation
Correct answer: A, B, D, E, F. Sensitive; Private; Confidential; Secret; Public
Public and commercial data classification systems typically use these standard classification levels: Public (lowest sensitivity, no restrictions), Sensitive (requires protection, limited distribution), Private (restricted to authorized personnel), Confidential (highly restricted, significant harm if disclosed), and Secret (highest classification for commercial systems, most restricted). These five levels provide a comprehensive framework for organizations to classify data based on sensitivity and required protection. Unclassified is primarily a government military classification term and is not standard in commercial data classification systems.
Why the other options are wrong
- C. Unclassified is a government/military classification term, not a standard commercial data classification level.
Question 42
Which of the following techniques is used when a system performs the penetration testing with the objective of accessing unauthorized information residing inside a computer?
Show answer and explanation
Correct answer: C. Port scanning
Port scanning is a reconnaissance technique used during penetration testing to identify open ports and services on a target system, which can lead to discovering vulnerabilities and accessing unauthorized information. Biometrician relates to biometric authentication, Van Eck Phreaking involves electromagnetic eavesdropping on computer emissions, and Phreaking is telephone system exploitation, none are primary penetration testing techniques for accessing unauthorized computer information.
Why the other options are wrong
- A. Biometrician refers to biometric identification systems, not a penetration testing technique.
- B. Van Eck Phreaking is electromagnetic eavesdropping, not a method for penetration testing computer systems.
- D. Phreaking targets telephone systems, not computer systems for accessing information.
Question 43
Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security controls. Which of the following are the international information security standards? Each correct answer represents a complete solution. Choose all that apply.
Show answer and explanation
Correct answer: B, C, D. Human resources security; Organization of information security; Risk assessment and treatment
ISO/IEC 27002 is the international standard for information security controls and management. It includes clauses on Human Resources Security (covering employee security responsibilities), Organization of Information Security (defining roles and responsibilities), and Risk Assessment and Treatment (core risk management processes). Option A refers to NIST's AU (Audit and Accountability) control family, which is part of the U.S. federal framework rather than the primary international standard framework.
Why the other options are wrong
- A. AU audit and accountability is a NIST control family specific to U.S. federal systems, not an ISO/IEC 27002 clause.
Question 44
You work as a security engineer for BlueWell Inc. Which of the following documents will you use as a guide for the security certification and accreditation of Federal Information Systems?
Show answer and explanation
Correct answer: C. NIST Special Publication 800-37
NIST Special Publication 800-37 provides the Risk Management Framework (RMF) and guidance for security certification and accreditation of federal information systems. It is the authoritative document for C&A processes in federal environments.
Why the other options are wrong
- A. NIST SP 800-60 addresses security categorization of federal information and information systems.
- B. NIST SP 800-53 provides security controls and their assessment procedures, but is not the primary C&A guidance document.
- D. NIST SP 800-59 addresses guidance on contingency planning, not certification and accreditation.
Question 45
Bill is the project manager of the JKH Project. He and the project team have identified a risk event in the project with a high probability of occurrence and the risk event has a high cost impact on the project. Bill discusses the risk event with Virginia, the primary project customer, and she decides that the requirements surrounding the risk event should be removed from the project. The removal of the requirements does affect the project scope, but it can release the project from the high risk exposure. What risk response has been enacted in this project?
Show answer and explanation
Correct answer: D. Avoidance
Avoidance is the risk response strategy of eliminating the risk by removing the source of the risk or the activity that creates the risk. By removing the requirements associated with the high-risk event, the project team eliminates the risk entirely rather than accepting, mitigating, or transferring it.
Why the other options are wrong
- A. Mitigation reduces the probability or impact of the risk, but the requirements were removed entirely, not reduced.
- B. Transference shifts the risk to a third party, such as through insurance or outsourcing, which did not occur here.
- C. Acceptance acknowledges the risk and prepares contingency plans, but the risk was eliminated, not accepted.
Question 46
Which of the following governance bodies directs and coordinates implementations of the information security program?
Show answer and explanation
Correct answer: B. Information Security Steering Committee
The Information Security Steering Committee is the governance body that directs and coordinates implementations of the information security program across the organization. This committee provides strategic oversight and decision-making authority for enterprise-wide information security initiatives and priorities.
Why the other options are wrong
- A. The Chief Information Security Officer is the executive leader who oversees the program but does not constitute a governance body that directs and coordinates.
- C. Business Unit Managers oversee specific business units but do not coordinate organization-wide information security program implementation.
- D. Senior Management provides support and resources but the Information Security Steering Committee is the specific governance body chartered with directing and coordinating the program.
Question 47
Which of the following ISO standards provides guidelines for accreditation of an organization that is concerned with certification and registration related to ISMS?
Show answer and explanation
Correct answer: A. ISO 27006
ISO 27006 provides guidelines for accreditation of organizations that are concerned with certification and registration related to Information Security Management Systems (ISMS). It specifies requirements and guidance for bodies providing audit and certification of ISMS.
Why the other options are wrong
- B. ISO 27005 addresses risk management for information security and does not cover accreditation of organizations performing ISMS certification.
- C. ISO 27003 is not a published standard in the ISO 27000 series; it is not used for ISMS accreditation guidelines.
- D. ISO 27004 focuses on monitoring, measurement, analysis and evaluation of ISMS effectiveness, not accreditation of certification bodies.
Question 48
Martha works as a Project Leader for BlueWell Inc. She and her team have developed accounting software. The software was performing well. Recently, the software has been modified. The users of this software are now complaining about the software not working properly. Which of the following actions will she take to test the software?
Show answer and explanation
Correct answer: B. Perform regression testing
Regression testing is performed after software modifications to ensure that changes have not negatively affected previously functioning features. Since the accounting software was working well and has been recently modified with users now reporting problems, regression testing identifies whether the modifications introduced defects in existing functionality.
Why the other options are wrong
- A. Integration testing verifies that different modules work together correctly, not specifically focused on post-modification issues.
- C. Unit testing examines individual components in isolation and would have been performed during initial development.
- D. Acceptance testing validates that the software meets user requirements and is typically performed for new systems or major releases.
Question 49
Which of the following is the process of finding weaknesses in cryptographic algorithms and obtaining the plaintext or key from the ciphertext?
Show answer and explanation
Correct answer: D. Cryptanalysis
Cryptanalysis is the process of finding weaknesses in cryptographic algorithms and techniques to obtain plaintext or keys from ciphertext without authorized access. It represents the art and science of breaking encryption systems through mathematical analysis, pattern recognition, and algorithmic attacks.
Why the other options are wrong
- A. Cryptographer is a person who designs or analyzes cryptographic systems, not the process of breaking encryption.
- B. Cryptography is the practice of creating secure communications through encryption, the opposite of cryptanalysis.
- C. Kerberos is a network authentication protocol and is unrelated to the process of breaking cryptographic systems.
Question 50
Which of the following testing methods tests the system efficiency by systematically selecting the suitable and minimum set of tests that are required to effectively cover the affected changes?
Show answer and explanation
Correct answer: D. Regression testing
Regression testing is the systematic testing method that selects a minimum set of tests to effectively verify that changes do not break existing functionality and that the system continues to work correctly. It specifically targets affected changes by choosing suitable test cases that provide effective coverage while minimizing the total test suite.
Why the other options are wrong
- A. Unit testing focuses on individual components in isolation, not on systematically covering affected changes across the system.
- B. Integration testing verifies interactions between components but is not specifically designed around selecting minimum test sets for change coverage.
- C. Acceptance testing validates whether the system meets business requirements, not whether specific changes have been properly tested for impact.
Question 51
Which of the following access control models uses a predefined set of access privileges for an object of a system?
Show answer and explanation
Correct answer: D. Mandatory Access Control
Mandatory Access Control (MAC) uses a predefined set of access privileges established by system administrators based on security labels and classifications. Access decisions are enforced by the system and cannot be changed by object owners. This contrasts with discretionary models where owners control access, and role-based models where job functions determine permissions.
Why the other options are wrong
- A. Role-Based Access Control defines privileges based on user roles, not predetermined system classifications.
- B. Discretionary Access Control allows object owners to define and modify access privileges.
- C. Policy Access Control is not a standard access control model terminology.
Question 52
You work as a project manager for a company. The company has started a new security software project. The software configuration management will be used throughout the lifecycle of the project. You are tasked to modify the functional features and the basic logic of the software and then make them compatible to the initial design of the project. Which of the following procedures of the configuration management will you follow to accomplish the task?
Show answer and explanation
Correct answer: B. Configuration control
Configuration control is the procedure used to modify functional features and basic logic while maintaining compatibility with the initial design. It manages changes to the software baseline, ensuring that modifications are controlled, documented, and aligned with project requirements and design standards.
Why the other options are wrong
- A. Configuration status accounting tracks and reports the status of changes, not the process of making compatible modifications
- C. Configuration audits verify compliance with requirements but do not execute the modifications themselves
- D. Configuration identification establishes the baseline configuration, not the process of modifying and updating it
Question 53
Which of the following vulnerabilities occurs when an application directly uses or concatenates potentially hostile input with data file or stream functions?
Show answer and explanation
Correct answer: D. Injection flaw
Injection flaws occur when an application directly uses or concatenates potentially hostile input with data file or stream functions, SQL queries, or other command structures without proper validation or parameterization. This allows attackers to inject malicious code or commands that are executed by the application, compromising system security. Injection flaws include SQL injection, OS command injection, and similar vulnerabilities where untrusted input is passed directly to interpreters. Insecure cryptographic storage involves weak encryption, malicious file execution involves executing untrusted files, and insecure communication involves unencrypted data transmission, none of which are specifically about concatenating hostile input with command functions.
Why the other options are wrong
- A. Insecure cryptographic storage refers to weakly encrypted or unencrypted sensitive data, not input concatenation.
- B. Malicious file execution involves uploading and running untrusted files, not concatenating input into commands.
- C. Insecure communication involves transmitting sensitive data over unencrypted channels, not input concatenation vulnerabilities.
Question 54
Which of the following access control models are used in the commercial sector? Each correct answer represents a complete solution. Choose two.
Show answer and explanation
Correct answer: A, C. Biba model; Clark-Wilson model
The Clark-Wilson model and the Biba model are both used in the commercial sector. Clark-Wilson is an integrity-focused model widely adopted in commercial environments for protecting data integrity in transactions. The Biba model, while developed for military use, has commercial applications. Bell-LaPadula and Clark-Biba are primarily military or theoretical models not commonly deployed in commercial access control implementations.
Why the other options are wrong
- B. The Clark-Biba model is not a standard commercial access control model and is rarely used in commercial sector implementations.
- D. The Bell-LaPadula model is primarily a military confidentiality model designed for classified systems and is not commonly used in commercial sector access control.
Question 55
Which of the following is the duration of time and a service level within which a business process must be restored after a disaster in order to avoid unacceptable consequences associated with a break in business continuity?
Show answer and explanation
Correct answer: A. RTO
The Recovery Time Objective (RTO) is the maximum duration of time and service level within which a business process must be restored after a disaster to avoid unacceptable consequences. RTA refers to recovery time assurance, RPO is the recovery point objective relating to data loss tolerance, and RCO is not a standard business continuity term.
Why the other options are wrong
- B. RTA (Recovery Time Assurance) refers to guaranteed recovery time but is not the standard term for the duration and service level requirement.
- C. RPO (Recovery Point Objective) specifies the maximum acceptable data loss, not the time duration for restoring the system.
- D. RCO is not a recognized business continuity metric or term.
Question 56
Martha registers a domain named Microsoft.in. She tries to sell it to Microsoft Corporation. The infringement of which of the following has she made?
Show answer and explanation
Correct answer: B. Trademark
Trademark infringement occurs when someone registers or uses a domain name confusingly similar to a protected trademark without authorization. Microsoft is a registered trademark, and registering Microsoft.in exploits the brand recognition and creates confusion in the marketplace, constituting trademark infringement.
Why the other options are wrong
- A. Copyright protects original works of authorship such as text and code, not domain names or brand names.
- C. Patent infringement relates to inventions and technical processes, not domain name registration.
- D. While trademark is part of intellectual property law, the specific violation here is trademark infringement, not general intellectual property infringement.
Question 57
Which of the following security controls will you use for the deployment phase of the SDLC to build secure software? Each correct answer represents a complete solution. Choose all that apply.
Show answer and explanation
Correct answer: A, C. Change and Configuration Control; Vulnerability Assessment and Penetration Testing
During the deployment phase of the SDLC, Change and Configuration Control ensures that code changes are properly managed and tracked in production environments, while Vulnerability Assessment and Penetration Testing validate that the deployed application meets security requirements and identify any weaknesses before full operational use.
Why the other options are wrong
- B. Security Certification and Accreditation is a formal authorization process that occurs at the system level, not specifically a control used during code deployment.
- D. Risk Adjustments is not a standard security control framework or process used in the SDLC deployment phase.
Question 58
Which of the following is designed to detect unwanted attempts at accessing, manipulating, and disabling of computer systems through the Internet?
Show answer and explanation
Correct answer: C. IDS
An Intrusion Detection System (IDS) is specifically designed to detect unwanted attempts at accessing, manipulating, and disabling computer systems through the Internet. It monitors network traffic and system activity for suspicious patterns and potential security breaches. DAS (Distributed Antenna Systems) refers to telecommunications infrastructure, IPsec is an encryption protocol, and ACLs are access control lists for permissions management.
Why the other options are wrong
- A. DAS refers to distributed antenna systems used in telecommunications, not intrusion detection.
- B. IPsec is an encryption and authentication protocol, not a detection system.
- D. ACLs (Access Control Lists) manage permissions for authorized access, not detect unauthorized attempts.
Question 59
Which of the following are the principle duties performed by the BIOS during POST (power-on-self-test)? Each correct answer represents a part of the solution. Choose all that apply.
Show answer and explanation
Correct answer: B, D, E. It identifies, organizes, and selects boot devices; It discovers size and verifies system memory; It verifies the integrity of the BIOS code itself.
During POST, the BIOS performs critical hardware initialization and verification tasks. It identifies and selects boot devices to determine the startup sequence, discovers the amount of system memory and verifies it is functioning correctly, and verifies the integrity of the BIOS code itself through checksums to ensure the firmware has not been corrupted. These are core diagnostic and initialization functions. Providing a user interface for configuration occurs after POST completes, and the BIOS does not interrupt running programs during POST since no programs are running yet, POST occurs before the operating system loads.
Why the other options are wrong
- A. Configuration interfaces are accessed after POST completes, not during it.
- C. BIOS does not delegate control to other BIOS during POST; this is not a standard POST function.
- F. No programs are running during POST, so interrupting them is not applicable.
Question 60
Which of the following are the primary functions of configuration management? Each correct answer represents a complete solution. Choose all that apply.
Show answer and explanation
Correct answer: B, C, D. It ensures that the change is implemented in a sequential manner through formalized testing; It reduces the negative impact that the change might have had on the computing services and resources; It analyzes the effect of the change that is implemented on the system.
Configuration management ensures changes are implemented through formalized testing processes (B), analyzes the effects of implemented changes on systems (D), and reduces negative impacts on computing services and resources (C). Option A is incorrect because configuration management does not remove risk entirely, no process can eliminate all risk. Configuration management is a control mechanism that manages and mitigates risk through structured change processes, testing, and impact analysis.
Why the other options are wrong
- A. Configuration management cannot eliminate risk entirely; it only manages and mitigates risk through structured processes.
Question 61
Which of the following is a variant with regard to Configuration Management?
Show answer and explanation
Correct answer: C. A CI that has the same essential functionality as another CI but a bit different in some small manner.
A variant in configuration management refers to a Configuration Item that maintains the same essential functionality as another CI but differs in minor aspects such as version, build, platform, or implementation details. Variants share a common baseline while accommodating specific variations for different environments or requirements.
Why the other options are wrong
- A. A CI with the same name but no relationship describes a naming conflict, not a variant.
- B. A software version is an example of how variants may differ, but this describes the nature of the difference rather than the definition of a variant.
- D. A hardware specification may be part of a variant, but this does not define what a variant is in configuration management terms.
Question 62
Which of the following refers to a process that is used for implementing information security?
Show answer and explanation
Correct answer: D. Information Assurance (IA)
Information Assurance (IA) is the process used for implementing information security, encompassing confidentiality, integrity, availability, authenticity, and non-repudiation across systems and data. The Classic Information Security Model describes principles rather than implementation processes, the Five Pillars model is not a standard implementation framework, and Certification and Accreditation is a compliance evaluation process rather than an implementation methodology.
Why the other options are wrong
- A. The Classic Information Security Model describes security principles, not a process for implementing security.
- B. The Five Pillars model is not a recognized standard framework for implementing information security.
- C. Certification and Accreditation is an assessment and approval process, not a process for implementing security controls.
Question 63
Which of the following is a signature-based intrusion detection system (IDS) ?
Show answer and explanation
Correct answer: D. Snort
Snort is a widely-used signature-based intrusion detection system that identifies attacks by comparing network traffic against a database of known attack signatures. It matches packets and flows against predefined patterns representing known threats and exploits.
Why the other options are wrong
- A. RealSecure is a behavior-based or anomaly-based IDS that detects threats through behavioral analysis rather than signature matching.
- B. StealthWatch is a network traffic analysis and behavior-based monitoring tool focused on anomalies rather than signatures.
- C. Tripwire is a file integrity monitoring tool, not an intrusion detection system.
Question 64
What are the various activities performed in the planning phase of the Software Assurance Acquisition process? Each correct answer represents a complete solution. Choose all that apply.
Show answer and explanation
Correct answer: A, C, D. Develop software requirements; Develop evaluation criteria and evaluation plan; Create acquisition strategy.
The planning phase of the Software Assurance Acquisition process includes developing software requirements to define what the system must do, developing evaluation criteria and plans to measure assurance, and creating an acquisition strategy to guide procurement and development. Implementing change control procedures is a later execution activity, not a planning phase activity.
Why the other options are wrong
- B. Implementing change control procedures occurs during execution and monitoring phases, not the planning phase.
Question 65
You work as a Security Manager for Tech Perfect Inc. In the organization, Syslog is used for computer system management and security auditing, as well as for generalized informational, analysis, and debugging messages. You want to prevent a denial of service (DoS) for the Syslog server and the loss of Syslog messages from other sources. What will you do to accomplish the task?
Show answer and explanation
Correct answer: C. Limit the number of Syslog messages or TCP connections from a specific source for a certain time period.
Limiting the number of Syslog messages or TCP connections from a specific source over a time period prevents denial-of-service attacks against the Syslog server. This rate-limiting technique controls the volume of inbound traffic, preventing overwhelming floods while maintaining legitimate message processing.
Why the other options are wrong
- A. Using a different message format would eliminate Syslog capabilities rather than protect them
- B. While redundant storage improves availability, it does not prevent DoS attacks on the server itself
- D. Encrypting rotated logs addresses confidentiality but does not prevent denial-of-service attacks
Question 66
Stella works as a system engineer for BlueWell Inc. She wants to identify the performance thresholds of each build. Which of the following tests will help Stella to achieve her task?
Show answer and explanation
Correct answer: B. Performance test
Performance testing is the methodology used to identify and evaluate the performance thresholds of each build. This testing measures system response time, throughput, resource utilization, and other performance characteristics to establish acceptable performance baselines and thresholds.
Why the other options are wrong
- A. Reliability testing verifies that a system functions consistently over time, not specifically for identifying performance thresholds.
- C. Regression testing ensures that new changes do not adversely affect existing functionality, not for identifying performance thresholds.
- D. Functional testing verifies that system functions work as intended but does not measure performance thresholds and metrics.
Question 67
Which of the following features of SIEM products is used in analysis for identifying potential problems and reviewing all available data that are associated with the problems?
Show answer and explanation
Correct answer: D. Incident tracking and reporting
Incident tracking and reporting is the SIEM feature used to identify potential problems and review all available data associated with those problems. This capability allows security analysts to track security incidents from detection through resolution and maintain detailed records and reports for analysis and compliance purposes.
Why the other options are wrong
- A. Security knowledge base stores known threat patterns and signatures but is not the primary feature for analyzing and correlating associated problem data.
- B. Graphical user interface is a presentation tool, not the analytical feature that identifies problems and correlates associated data.
- C. Asset information storage and correlation manages asset data but does not specifically function for incident problem analysis and tracking.
That was 67 of 350.
The full ISC2 CSSLP pack has all 350 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 165 free as one PDF by email. Get the Half Pack →