CISSP practice questions — 10 free

A BIA physical-asset inventory includes tangible assets owned or controlled by the organization that support critical business processes. Supplies stored at an off-site recovery facility are physical resources that may be needed to restore operations, so they belong in the inventory.

High availability requires eliminating major single points of failure, including the server location. Multiple geographically dispersed web servers configured for failover allow service to continue if one server, site, network, or region becomes unavailable.

Explanation/Reference: Explanation: Some biometric systems base authentication decisions on physical attributes such as iris, retina, or fingerprints. Incorrect Answers: A: Micrometrics is a business term used for measures that support the improvement and management of a particular project, program or initiative. B: Macrometrics is a business term used for the overall organization or cross-functional metrics used to drive strategy. D: MicroBiometrics is not a technology that uses fingerprint, retina, and iris scans to authenticate the individuals requesting access to resources References: Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 187 http://www.humanresourcesiq.com/hr-technology/columns/macro-vs-micro-metrics/

The most severe impact is deploying software containing insecure code into the environment. Without a documented software assurance policy, the organization may lack consistent security requirements, code and vulnerability review, and predeployment security testing, creating a direct risk of compromise and data disclosure.

Explanation/Reference: Explanation: White box software testing gives the tester access to program source code, data structures, variables, etc. White box testing gives the tester access to the internal logical structure of the program, while black box testing gives the tester no internal details: The software is treated as a black box that receives inputs. Incorrect Answers: A: White-box testing can be performed by any programmer who has access the source code. B: Black-box testing just hides the internal details of the program. Black-box testing does not use either a bottom-up, or top down approach. D: Black-box testing is blind to business units, as it has not access to any internal details of the program. References: Conrad, Eric, Seth Misenar and Joshua Feldman, CISSP Study Guide, 2nd Edition, Syngress, Waltham, 2012, p. 194

Explanation/Reference: Explanation: The one-time pad encryption scheme is considered unbreakable only if: The pad is used only one time. The pad is as long as the message. The pad is securely distributed and protected at its destination. The pad is made up of truly random values. Incorrect Answers: A, B: Symmetric ciphers and DES electronic code books are part of symmetric encryption, which are susceptible to brute force and cryptanalysis attacks. D: Elliptic curve cryptography is not known to be unbreakable, as it is susceptible to a modified Shor's algorithm for solving the discrete logarithm problem on elliptic curves. References: Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 771-773 http://www.encryptionanddecryption.com/encryption/symmetric_encryption.html https://en.wikipedia.org/wiki/Elliptic_curve_cryptography#Security

Explanation/Reference: Explanation: Both SET and S-HTTP provides application layer security. Incorrect Answers: B: SET and S-HTTP work at the application layer, not at the transportation layer. C: SET and S-HTTP work at the session layer, not at the transportation layer. D: SET and S-HTTP work at the network layer, not at the transportation layer. References: Stewart, James M., Ed Tittel, and Mike Chapple, CISSP: Certified Information Systems Security Professional Study Guide, 5th Edition, Sybex, Indianapolis, 2011, p. 856

Explanation/Reference: Explanation: Compiled code poses more of a security risk than interpreted code because of malicious code can be embedded in the compiled code and be difficult to detect. Incorrect Answers: B: Compiled code that fails would be an example of an application runtime error, which in itself is no security risk. C: Compilers are to be trusted. D: Compiled code is more of a security risk. References: Krutz, Ronald L and Russell Dean Vines, The CISSP and CAP Prep Guide: Mastering CISSP and CAP, Wiley Publishing, Indianapolis, 2007, p 425

The type of database attack that would allow a customer service employee to determine quarterly sales results before they are publicly announced is inference. Inference is a type of database attack where an attacker or a malicious user obtains or deduces some sensitive or confidential information or data from the database, by using some legitimate or authorized information or data, and applying some logic, reasoning, or analysis. Inference can allow a customer service employee to determine quarterly sales results before they are publicly announced, because the customer service employee may have some legitimate or authorized access to some information or data from the database, such as the number of orders, the amount of sales, or the customer feedback, and they may use some logic, reasoning, or analysis to infer or estimate the quarterly sales results from that information or data. The other options are not the types of database attack that would allow a customer service employee to determine quarterly sales results before they are publicly announced. Polyinstantiation is not a type of database attack, but rather a type of database technique that allows multiple versions or instances of the same information or data to exist in the database, at different levels of security or classification, and for different users or groups. Polyinstantiation can prevent or reduce the inference attacks, by creating some inconsistency or ambiguity in the information or data, and making it harder or impossible for the attacker or the malicious user to infer or deduce the sensitive or confidential information or data. Aggregation is not a type of database attack, but rather a type of database operation that combines or summarizes some information or data from the database, and produces some output or result, such as the average, the sum, or the count. Aggregation can enable or facilitate the inference attacks, by providing some information or data that can be used by the attacker or the malicious user to infer or deduce the sensitive or confidential information or data. Data mining is not a type of database attack, but rather a type of database process that analyzes and extracts some useful or valuable information or data from the database, by using some techniques or methods, such as statistics, machine learning, or artificial intelligence. Data mining can enable or facilitate the inference attacks, by providing some techniques or methods that can be used by the attacker or the malicious user to infer or deduce the sensitive or confidential information or data. References: [CISSP All-in-One Exam Guide, Eighth Edition], Chapter 6: Identity and Access Management, page 713. [Official (ISC)2 CISSP CBK Reference, Fifth Edition], Chapter 6: Identity and Access Management, page 714.

Explanation/Reference: Explanation: Because fiber-optic cable passes electrically non-conducting photons through a glass medium, it is very hard to intercept or wiretap. Incorrect Answers: A: High data rates are an advantage of fiber options, but speed in itself does not significantly increase speed. C: Multiplexing would not prevent traffic analysis. It would just make it harder. D: Correctable bits are not an advantage of fiber optic communication.