Questions: CISSP CBK Final Exam


51. The three primary methods for authenticating users to a system or network are…?

52. Pretty Good Privacy (PGP) provides…?

53. Which of the following can be identified when exceptions occur using operations security detective controls?

54. When downloading software from Internet, why do vendors publish MD5 hash values when they provide software to customers?

55. From a legal perspective, which rule must be addressed when investigating a computer crime?

56. Before powering off a computer system, a computer crime investigator should record contents of the monitor and…?

57. Which of the following transaction processing properties ensures once a transaction completes successfully (commits), the updates survive even if there is a system failure?

58. Which of the following is not a symmetric key algorithm?

59. A security planning process must defines: how security will be managed, who will be responsible, and…?

60. A security policy provides a way to…?

61. Which of the following feature does a digital signature provide?

62. Computer security is generally considered to be the responsibility of…?

63. The practice of embedding a message in a document, image, video or sound recording so that its very existence is hidden is called?

64. What characteristic of Digital Encryption Standard (DES) used in Electronic Code Book (ECB) mode makes it unsuitable for long messages?

65. Separation of duties should be…?

66. What is the advantage of Rivest, Shamir, Adelman (RSA) public key system over the Digital Signature Algorithm (DSA)?

67. In IPsec, what is the standard format that helps to establish and manage the security association (SA) between two internetworking entities?

68. When securing Internet connections which of the following should be used to protect internal routing and labeling schemes?

69. Which of the following describes the step prior to an encrypted session using Data Encryption Standard (DES)?

70. What is a set of step-by-step instructions used to satisfy control requirements called?

71. The accounting branch of a large organization requires an application to process expense vouchers. Each voucher must be input by one of many accounting clerks, verified by the clerk’s applicable supervisor, then reconciled by an auditor before the reimbursement check is produced. Which access control technique should be built into the application to best serve these requirements?

72. What principle recommends division of responsibilities so that one person cannot commit an undetected fraud?

73. In what situation would TEMPEST risks and technologies be of most interest?

74. Which of the following is true about information that is designated with the highest level of confidentiality in a private sector organization?

75. When verifying key control objectives of a system design, the security specialist should ensure that the…?

76. What type of controls is not utilized to achieve management directives to protect company assets?

77. All of the followings are hashing algorithms except…?

78. Security management practice focuses on the continual protection of:

79. The likelihood of a threat source taking advantage of a vulnerability is called?

80. An instance of being exposed to losses is called?

81. Reference monitor requires which of the following conditions?

82. A person in possession of a sample of ciphertext and corresponding plaintext is capable of what type of attack?

83. Methods of handling risk include all of the followings except:

84. Which of the following is not true regarding security policy?

85. Which of the following describes the activities that assure protection mechanisms are maintained and operational?

86. When there is a “separation of duties”, parts of tasks are assigned to different people so that:

87. Which of the following is not a generally accepted benefit of security awareness, training and education?

88. Which statement below is an incorrect description of a security control?

89. Physical security is accomplished through proper facility construction, fire and water protection, anti-theft mechanisms, intrusion detection systems, and security procedures that are adhered to and enforced. Which of the following is not a component that achieves this type of security?

90. In a typical information security program, who would be responsible for providing reports to the corporate executives and senior management on the effectiveness of the instituted program controls?

91. What is the difference between quantitative and qualitative risk analysis?

92. If risk is defined as “the potential that a given threat will exploit vulnerabilities of an asset or group of assets to cause loss or damage to the assets” the risk has all of the following elements except?

93. Which statement below most accurately reflects the goal of risk mitigation?

94. Risk analysis allows you to do all of the following except:

95. Which of the following is not true with respect to qualitative risk analysis?

96. Which choice below is an accurate statement about standards?

97. A memory address location specified in a program instruction that contains the address of final memory location is known as:

99. A processing methodology that executes two or more tasks on a single processor is known as:

100. Which of the following is a high-level language?

101. Which of the followings are security concerns with distributed systems?

1  2  3  4  5