[Oct 20, 2023] Pass CISSP Review Guide, Reliable CISSP Test Engine [Q784-Q801]

10 月 20, 2023 CISSP, ISC 0 评论

[2023年10月20日] 通过CISSP复习指南，可靠的CISSP测试引擎 [Q784-Q801]

4.5/5 - (12 选票)

[Oct 20, 2023] Pass CISSP Review Guide, Reliable CISSP Test Engine

CISSP Test Engine Practice Test Questions, Exam Dumps

NO.784 What works as an E-mail message transfer agent?

SMTP

简单网络管理协议

S-RPC

S/MIME

NO.785 Who should measure the effectiveness of Information System security related controls in an organization?

The local security specialist

The business manager

The systems auditor

The central security manager

NO.786 Which of the following packets should NOT be dropped at a firewall protecting an organization’s internal network?

Inbound packets with Source Routing option set

Router information exchange protocols

Inbound packets with an internal source IP address

Outbound packets with an external destination IP address

NO.787 Which of the following is NOT a use of an audit trail?

Collects information such as passwords or infrastructure configurations

Enables the security practitioner to trace a transaction’s history

Provides information about additions, deletions, or modifications to the data

Assists the monitoring function by helping to recognize patterns of abnormal user behavior

NO.788 Which of the following is a problem regarding computer investigation issues?

Information is tangible.

Evidence is easy to gather.

Computer-generated records are only considered secondary evidence, thus are not as reliable as best evidence.

In many instances, an expert or specialist is not required.

NO.789 The concept of least privilege currently exists within the context of:

ISO

TCSEC

OSI

IEFT

NO.790 A criminal organization is planning an attack on a government network. Which of the following is the MOST severe attack to the network availability?

Network management communications is disrupted

Operator loses control of network devices to attacker

Sensitive information is gathered on the network topology by attacker

Network is flooded with communication traffic by attacker

NO.791 An organization discovers that its Secure File Transfer Protocol (SFTP) server has been accessed by an unauthorized person to download an unreleased game. A recent security audit found weaknesses in some of the organization’s general Information Technology (IT) controls, specifically pertaining to software change control and security patch management, but not in other control areas.
Which of the following is the MOST probable attack vector used in the security breach?

缓冲区溢出

分布式拒绝服务（DDoS）

Cross-Site Scripting (XSS)

Weak password due to lack of complexity rules

NO.792 Which of the following BEST describes a rogue Access Point (AP)?

An AP that is not protected by a firewall

An AP not configured to use Wired Equivalent Privacy (WEP) with Triple Data
Encryption Algorithm (3DES)

An AP connected to the wired infrastructure but not under the management of authorized network administrators

An AP infected by any kind of Trojan or Malware

NO.793 Which of the following is the BEST metric to obtain when gaining support for an Identify and Access Management (IAM) solution?

Application connection successes resulting in data leakage

Administrative costs for restoring systems after connection failure

Employee system timeouts from implementing wrong limits

Help desk costs required to support password reset requests

NO.794 The top speed of ISDN BRI is 256 KBS.(True/False)

正确

假的

NO.795 The Wired Equivalency Privacy algorithm (WEP) of the 802.11 Wireless
LAN Standard uses which of the following to protect the confidentiality
of information being transmitted on the LAN?

A digital signature that is sent between a mobile station (e.g., a laptop with a wireless Ethernet card) and a base station access point

A public/private key pair that is shared between a mobile station (e.g., a laptop with a wireless Ethernet card) and a base station access point

A secret key that is shared between a mobile station (e.g., a laptop with a wireless Ethernet card) and a base station access point

Frequency shift keying (FSK) of the message that is sent between a mobile station (e.g., a laptop with a wireless Ethernet card) and a base station access point

NO.796 You are part of a security staff at a highly profitable bank and each day, all traffic on the network is logged for later review. Every Friday when major deposits are made you’re seeing a series of bits placed in the “Urgent Pointer” field of a TCP packet. This is only 16 bits which isn’t much but it concerns you because:

This could be a sign of covert channeling in bank network communications and should be investigated.

It could be a sign of a damaged network cable causing the issue.

It could be a symptom of malfunctioning network card or drivers and the source system should be checked for the problem.

It is normal traffic because sometimes the previous fields 16 bit checksum value can over run into the urgent pointer’s 16 bit field causing the condition.

The Urgent Pointer is used when some information has to reach the server ASAP. When the TCP/IP stack at the other end sees a packet using the Urgent Pointer set, it is duty bound to stop all ongoing activities and immediately send this packet up the stack for immediate processing. Since the packet is plucked out of the processing queue and acted upon immediately, it is known as an Out Of Band (OOB) packet and the data is called Out Of Band (OOB) data.
The Urgent Pointer is usually used in Telnet, where an immediate response (e.g. the echoing of characters) is desirable. Covert Channels are not directly synonymous with backdoors. A covert channel is simply using a communication protocol in a way it was not intended to be used or sending data without going through the proper access control mechanisms or channels. For example, in a Mandatory Access Control systems a user at secret has found a way to communicate information to a user at Confidential without going through the normal channels.
In this case the Urgent bit could be use for a few reasons:
1.It could be to attempt a Denial of service where the host receiving a packet with the Urgent bit set will give immediate attention to the request and will be in wait state until the urgent message is receive, if the sender does not send the urgent message then it will simply sit there doing nothing until it times out. Some of the TCP/IP stacks used to have a 600 seconds time out, which means that for 10 minutes nobody could use the port. By sending thousands of packet with the URGENT flag set, it would create a very effective denial of service attack.
2.It could be used as a client server application to transmit data back and forward without going through the proper channels. It would be slow but it is possible to use reserved fields and bits to transmit data outside the normal communication channels.
The other answers are incorrect The following reference(s) were/was used to create this question: http://www.vijaymukhi.com/vmis/tcp.htm and http://www.fas.org/irp/nsa/rainbow/tg030.htm document covering the subject of covert channels and also see: http://gray-world.net/papers.shtml which is a large collection of documents on Covert Channels

NO.797 Which of the BEST internationally recognized standard for evaluating security products and systems?

Payment Card Industry Data Security Standards (PCI-DSS)

Common Criteria (CC)

Health Insurance Portability and Accountability Act (HIPAA)

Sarbanes-Oxley (SOX)

NO.798 Which of the following command line tools can be used in the reconnaissance phase of a network vulnerability assessment?

挖掘

ipconfig

ifconfig

nbstat

NO.799 What is the maximum key size for the RC5 algorithm?

128 bits

256 bits

1024 bits

2040 bits

NO.800 Which term below MOST accurately describes the Trusted Computing
Base (TCB)?

A piece of information that represents the security level of an object

A computer that controls all access to objects by subjects

Formal proofs used to demonstrate the consistency between a systems specification and a security model

The totality of protection mechanisms within a computer system

The Trusted Computing Base (TCB) The totality of protection mechanisms within a computer system, including hardware, firmware, and software, the combination of which is responsible for enforcing a security policy. A TCB consists of one or more components that together enforce a unified security policy over a product or system. The ability of a trusted computing base to correctly enforce a security policy depends solely on the mechanisms within the TCB and on the correct input by system administrative personnel of parameters (e.g., a users clearance) related to the security policy. *Answer “A computer that controls all access to objects by subjects” describes the reference monitor concept. The reference monitor is an access control concept that refers to an abstract machine that mediates all accesses to objects by subjects. The Security Kernel consists of the hardware, firmware, and software elements of a Trusted Computing Base (or Network Trusted Computing Base partition) that implement the reference monitor concept. It must mediate all accesses, be protected from modification, and be verifiable as correct. *Answer “A piece of information that represents the security level of an object” refers to a sensitivity label. Asensitivity label is a piece of information that represents the extra security level of an object and describes the sensitivity (e.g., classification) of the data in the object. Sensitivity labels are used by the TCB as the basis for mandatory access control decisions. *Answer “Formal proofs used to demonstrate the consistency between a systems specification and a security model” describes formal verification. This is the process of using formal proofs to demonstrate the consistency (design verification) between a formal specification of a system and a formal security policy model or (implementation verification) between the formal specification and its program implementation. Source: DoD 5200.28-STD Department of Defense Trusted Computer System Evaluation Criteria

NO.801 What is called the percentage at which the False Rejection Rate equals the False Acceptance Rate?

False Rejection Rate (FRR) or Type I Error

False Acceptance Rate (FAR) or Type II Error

Crossover Error Rate (CER)

Failure to enroll rate (FTE or FER)