« 返回题库列表新版CISSP考试题库PDF下载｜最新CISSP真题及答案+高频考点解析
问题 #1
All of the following are basic components of a security policy EXCEPT the
A. definition of the issue and statement of relevant terms.
B. statement of roles and responsibilities
C. statement of applicability and compliance requirements.
D. statement of performance of characteristics and requirements.
问题 #2
A security policy would include all of the following EXCEPT
A. Background
B. Scope statement
C. Audit requirements
D. Enforcement
问题 #3
Which one of the following is an important characteristic of an information security policy?
A. Identifies major functional areas of information.
B. Quantifies the effect of the loss of the information.
C. Requires the identification of information owners.
D. Lists applications that support the business function.
问题 #4
Ensuring the integrity of business information is the PRIMARY concern of
A. Encryption Security
B. Procedural Security.
C. Logical Security
D. On-line Security
问题 #5
Which of the following would be the first step in establishing an information security program?
A. Adoption of a corporate information security policy statement
B. Development and implementation of an information security standards manual
C. Development of a security awareness-training program
D. Purchase of security access control software
问题 #6
Which of the following department managers would be best suited to oversee the development of an information security policy?
A. Information Systems
B. Human Resources
C. Business operations
D. Security administration
问题 #7
What is the function of a corporate information security policy?
A. Issue corporate standard to be used when addressing specific security problems.
B. Issue guidelines in selecting equipment, configuration, design, and secure operations.
C. Define the specific assets to be protected and identify the specific tasks which must be completed to secure them.
D. Define the main security objectives which must be achieved and the security framework to meet business objectives.
问题 #8
Why must senior management endorse a security policy?
A. So that they will accept ownership for security within the organization.
B. So that employees will follow the policy directives.
C. So that external bodies will recognize the organizations commitment to security.
D. So that they can be held legally accountable.
问题 #9
In which one of the following documents is the assignment of individual roles and responsibilities MOST appropriately defined?
A. Security policy
B. Enforcement guidelines
C. Acceptable use policy
D. Program manual
问题 #10
Which of the following defines the intent of a system security policy?
A. A definition of the particular settings that have been determined to provide optimum security.
B. A brief, high-level statement defining what is and is not permitted during the operation of the system.
C. A definition of those items that must be excluded on the system.
D. A listing of tools and applications that will be used to protect the system.
问题 #11
When developing an information security policy, what is the FIRST step that should be taken?
A. Obtain copies of mandatory regulations.
B. Gain management approval.
C. Seek acceptance from other departments.
D. Ensure policy is compliant with current working practices.
问题 #12
Which one of the following should NOT be contained within a computer policy?
A. Definition of management expectations.
B. Responsibilities of individuals and groups for protected information.
C. Statement of senior executive support.
D. Definition of legal and regulatory controls.
问题 #13
Which one of the following is NOT a fundamental component of a Regulatory Security Policy?
A. What is to be done.
B. When it is to be done.
C. Who is to do it.
D. Why is it to be done
问题 #14
Which one of the following statements describes management controls that are instituted to implement a security policy?
A. They prevent users from accessing any control function.
B. They eliminate the need for most auditing functions.
C. They may be administrative, procedural, or technical.
D. They are generally inexpensive to implement.
问题 #15
Which must bear the primary responsibility for determining the level of protection needed for information systems resources?
A. IS security specialists
B. Senior Management
C. Seniors security analysts
D. system auditors
问题 #16
Which of the following choices is NOT part of a security policy?
A. definition of overall steps of information security and the importance of security
B. statement of management intend, supporting the goals and principles of information security
C. definition of general and specific responsibilities for information security management
D. description of specific technologies used in the field of information security
问题 #17
In an organization, an Information Technology security function should:
A. Be a function within the information systems functions of an organization
B. Report directly to a specialized business unit such as legal, corporate security or insurance
C. Be lead by a Chief Security Officer and report directly to the CEO
D. Be independent but report to the Information Systems function
问题 #18
Which of the following embodies all the detailed actions that personnel are required to follow?
A. Standards
B. Guidelines
C. Procedures
D. Baselines
问题 #19
A significant action has a state that enables actions on an ADP system to be traced to individuals who may then be held responsible. The action does NOT include:
A. Violations of security policy.
B. Attempted violations of security policy.
C. Non-violations of security policy.
D. Attempted violations of allowed actions.
问题 #20
Network Security is a
A. Product
B. protocols
C. ever evolving process
D. quick-fix solution
问题 #21
Security is a process that is:
A. Continuous
B. Indicative
C. Examined
D. Abnormal
问题 #22
What are the three fundamental principles of security?
A. Accountability, confidentiality, and integrity
B. Confidentiality, integrity, and availability
C. Integrity, availability, and accountability
D. Availability, accountability, and confidentiality
问题 #23
Which of the following prevents, detects, and corrects errors so that the integrity, availability, and confidentiality of transactions over networks may be maintained?
A. Communications security management and techniques
B. Networks security management and techniques
C. Clients security management and techniques
D. Servers security management and techniques
问题 #24
Making sure that the data is accessible when and where it is needed is which of the following?
A. Confidentiality
B. integrity
C. acceptability
D. availability
问题 #25
Which of the following describes elements that create reliability and stability in networks and systems and which assures that connectivity is accessible when needed?
A. Availability
B. Acceptability
C. Confidentiality
D. Integrity
问题 #26
Most computer attacks result in violation of which of the following security properties?
A. Availability
B. Confidentiality
C. Integrity and control
D. All of the choices.
问题 #27
Which of the following are objectives of an information systems security program?
A. Threats, vulnerabilities, and risks
B. Security, information value, and threats
C. Integrity, confidentiality, and availability.
D. Authenticity, vulnerabilities, and costs.
问题 #28
An area of the Telecommunications and Network Security domain that directly affects the Information Systems Security tenet of Availability can be defined as:
A. Netware availability
B. Network availability
C. Network acceptability
D. Network accountability
问题 #29
The Structures, transmission methods, transport formats, and security measures that are used to provide integrity, availability, and authentication, and confidentiality for transmissions over private and public communications networks and media includes:
A. The Telecommunications and Network Security domain
B. The Telecommunications and Netware Security domain
C. The Technical communications and Network Security domain
D. The Telnet and Security domain
问题 #30
Which one of the following is the MOST crucial link in the computer security chain?
A. Access controls
B. People
C. Management
D. Awareness programs
问题 #31
The security planning process must define how security will be managed, who will be responsible, and
A. Who practices are reasonable and prudent for the enterprise.
B. Who will work in the security department.
C. What impact security will have on the intrinsic value of dat
A.
D. How security measures will be tested for effectiveness.
问题 #32
Information security is the protection of data. Information will be protected mainly based on:
A. Its sensitivity to the company.
B. Its confidentiality.
C. Its value.
D. All of the choices.
问题 #33
Organizations develop change control procedures to ensure that
A. All changes are authorized, tested, and recorded.
B. Changes are controlled by the Policy Control Board (PCB).
C. All changes are requested, scheduled, and completed on time.
D. Management is advised of changes made to systems.
问题 #34
Within the organizational environment, the security function should report to an organizational level that
A. Has information technology oversight.
B. Has autonomy from other levels.
C. Is an external operation.
D. Provides the internal audit function.
问题 #35
What is the MAIN purpose of a change control/management system?
A. Notify all interested parties of the completion of the change.
B. Ensure that the change meets user specifications.
C. Document the change for audit and management review.
D. Ensure the orderly processing of a change request.
问题 #36
Which of the following is most relevant to determining the maximum effective cost of access control?
A. the value of information that is protected
B': ") management's perceptions regarding data importance", 'C. budget planning related to base versus incremental spending.
D. the cost to replace lost data
问题 #37
Which one of the following is the MAIN goal of a security awareness program when addressing senior management?
A. Provide a vehicle for communicating security procedures.
B. Provide a clear understanding of potential risk and exposure.
C. Provide a forum for disclosing exposure and risk analysis.
D. Provide a forum to communicate user responsibilities.
问题 #38
In developing a security awareness program, it is MOST important to
A. Understand the corporate culture and how it will affect security.
B. Understand employees preferences for information security.
C. Know what security awareness products are available.
D. Identify weakness in line management support.
问题 #39
Which of the following would be best suited to provide information during a review of the controls over the process of defining IT service levels?
A. Systems programmer
B. Legal stuff
C. Business unit manager
D. Programmer
问题 #40
Which of the following best explains why computerized information systems frequently fail to meet the needs of users?
A. Inadequate quality assurance (QA) tools
B. Constantly changing user needs
C': ") Inadequate user participation in defining the system's requirements", 'D. Inadequate project management.
问题 #41
Which of the following is not a compensating measure for access violations?
A. Backups
B. Business continuity planning
C. Insurance
D. Security awareness
问题 #42
Risk analysis is MOST useful when applied during which phase of the system development process?
A. Project identification
B. Requirements definition
C. System construction
D. Implementation planning
问题 #43
Which one of the following is not one of the outcomes of a vulnerability analysis?
A. Quantative loss assessment
B. Qualitative loss assessment
C. Formal approval of BCP scope and initiation document
D. Defining critical support areas
问题 #44
Which of the following is not a part of risk analysis?
A. Identify risks
B. Quantify the impact of potential threats
C. Provide an economic balance between the impact of the risk and the cost of the associated countermeasures
D. Choose the best countermeasure
问题 #45
A new worm has been released on the Internet. After investigation, you have not been able to determine if you are at risk of exposure. Management is concerned as they have heard that a number of their counterparts are being affected by the worm. How could
A. Evaluate evolving environment.
B. Contact your anti-virus vendor.
C. Discuss threat with a peer in another organization.
D. Wait for notification from an anti-virus vendor.
问题 #46
When conducting a risk assessment, which one of the following is NOT an acceptable social engineering practice?
A. Shoulder surfing
B. Misrepresentation
C. Subversion
D. Dumpster diving
问题 #47
Which one of the following risk analysis terms characterizes the absence or weakness of a risk-reducing safegaurd?
A. Threat
B. Probability
C. Vulnerability
D. Loss expectancy
问题 #48
Risk is commonly expressed as a function of the
A. Systems vulnerabilities and the cost to mitigate.
B': "Types of countermeasures needed and the system's vulnerabilities. ", 'C. Likelihood that the harm will occur and its potential impact.
D. Computer system-related assets and their costs.
问题 #49
How should a risk be handled when the cost of the countermeasures outweighs the cost of the risk?
A. Reject the risk
B. Perform another risk analysis
C. Accept the risk
D. Reduce the risk
问题 #50
Which of the following is an advantage of a qualitative over quantitative risk analysis?
A. It prioritizes the risks and identifies areas for immediate improvement in addressing the vulnerabilities.
B. It provides specific quantifiable measurements of the magnitude of the impacts
C. It makes cost-benefit analysis of recommended controls easier
问题 #51
The absence or weakness in a system that may possibly be exploited is called a(n)?
A. Threat
B. Exposure
C. Vulnerability
D. Risk
问题 #52
What tool do you use to determine whether a host is vulnerable to known attacks?
A. Padded Cells
B. Vulnerability analysis
C. Honey Pots
D. IDS
问题 #53
Which of the following statements pertaining to ethical hacking is incorrect?
A. An organization should use ethical hackers who do not sell auditing, consulting, hardware, software, firewall, hosting, and/or networking services
B. Testing should be done remotely
C. Ethical hacking should not involve writing to or modifying the target systems
D. Ethical hackers should never use tools that have potential of exploiting vulnerabilities in the organizations IT system.
问题 #54
Why would an information security policy require that communications test equipment be controlled?
A. The equipment is susceptible to damage
B. The equipment can be used to browse information passing on a network
C. The equipment must always be available for replacement if necessary
D. The equipment can be used to reconfigure the network multiplexers
问题 #55
Management can expect penetration tests to provide all of the following EXCEPT
A. identification of security flaws
B. demonstration of the effects of the flaws
C. a method to correct the security flaws.
D. verification of the levels of existing infiltration resistance
问题 #56
Which one of the following is a characteristic of a penetration testing project?
A. The project is open-ended until all known vulnerabilities are identified.
B. The project schedule is plotted to produce a critical path.
C. The project tasks are to break into a targeted system.
D. The project plan is reviewed with the target audience.
问题 #57
Which one of the following is the PRIMARY objective of penetration testing?
A. Assessment
B. Correction
C. Detection
D. Protection
问题 #58
Open box testing, in the Flaw Hypothesis Methodology of Penetration Testing applies to the analysis of
A. Routers and firewalls
B. Host-based IDS systems
C. Network-based IDS systems
D. General purpose operating systems
问题 #59
What is the FIRST step that should be considered in a penetration test?
A. The approval of change control management.
B. The development of a detailed test plan.
C. The formulation of specific management objectives.
D. The communication process among team members.
问题 #60
Penetration testing will typically include
A. Generally accepted auditing practices.
B. Review of Public Key Infrastructure (PKI) digital certificate, and encryption.
C. Social engineering, configuration review, and vulnerability assessment.
D. Computer Emergency Response Team (CERT) procedures.
问题 #61
Which of the following is not a valid reason to use external penetration service firms rather than corporate resources?
A. They are more cost-effective
B. They offer a lack of corporate bias
C. They use highly talented ex-hackers
D. They insure a more complete reporting
问题 #62
Which of the following tools can you use to assess your networks vulnerability?
A. ISS
B. All of the choices.
C. SATAN
D. Ballista
问题 #63
Annualized Loss Expectancy (ALE) value is derived from an algorithm of the product of annual rate of occurrence and
A. Cost of all losses expected.
B': "Previous year's actual loss. ", 'C. Average of previous losses.
D. Single loss expectancy.
问题 #64
If your property insurance has Actual Cost Evaluation (ACV) clause your damaged property will be compensated:
A. Based on the value of the item on the date of loss
B. Based on new item for old regardless of condition of lost item
C. Based on value of item one month before loss
D. Based on value of item on the date of loss plus 10 percent
问题 #65
How is Annualized Loss Expectancy (ALE) derived from a threat?
A. ARO x (SLE - EF)
B. SLE x ARO
C. SLE/EF
D. AV x EF
问题 #66
Qualitative loss resulting from the business interruption does not include:
A. Loss of revenue
B. Loss of competitive advantage or market share
C. Loss of public confidence and credibility
D. Public embarrassment
问题 #67
Which risk management methodology uses the exposure factor multiplied by the asset value to determine its outcome?
A. Annualized Loss Expectancy
B. Single Loss Expectancy
C. Annualized Rate of Occurrence
D. Information Risk Management
问题 #68
Valuable paper insurance coverage does not cover damage to which of the following?
A. Inscribed, printed and written documents
B. Manuscripts
C. Records
D. Money and Securities
问题 #69
What is the window of time for recovery of information processing capabilities based on?
A. Quality of the data to be processed
B. Nature of the disaster
C. Criticality of the operations affected
D. Applications that are mainframe based
问题 #70
What is the Maximum Tolerable Downtime (MTD):
A. Maximum elapsed time required to complete recovery of application data
B. Minimum elapsed time required to complete recovery of application data
C. Maximum elapsed time required to move back to primary site a major disruption
D. It is maximum delay businesses that can tolerate and still remain viable
问题 #71
A "critical application" is one that MUST
A. Remain operational for the organization to survive.
B. Be subject to continual program maintenance.
C. Undergo continual risk assessments.
D. Be constantly monitored by operations management.
问题 #72
Which of the following questions is less likely to help in assessing physical and environmental protection?
A. Are entry codes changed periodically?
B. Are appropriate fire suppression and prevention devices installed and working?
C. Are there processes to ensure that unauthorized individuals cannot read, copy, alter, or steal printed or electronic information?
D. Is physical access to data transmission lines controlled?
问题 #73
A common Limitation of information classification systems is the INABILITY to
A. Limit the number of classifications.
B. Generate internal labels on diskettes.
C. Declassify information when appropriate.
D. Establish information ownership.
问题 #74
The purpose of information classification is to
A. Assign access controls.
B. Apply different protective measures.
C. Define the parameters required for security labels.
D. Ensure separation of duties.
问题 #75
Who should determine the appropriate access control of information?
A. Owner
B. User
C. Administrator
D. Server
问题 #76
What is the main responsibility of the information owner?
A. making the determination to decide what level of classification the information requires
B. running regular backups
C. audit the users when they require access to the information
D. periodically checking the validity and accuracy for all data in the information system
问题 #77
What process determines who is trusted for a given purpose?
A. Identification
B. Authorization
C. Authentication
D. Accounting
问题 #78
The intent of least privilege is to enforce the most restrictive user rights required
A. To execute system processes.
B. By their job description.
C. To execute authorized tasks.
D. By their security role.
问题 #79
What principle requires that a user be given no more privilege then necessary to perform a job?
A. Principle of aggregate privilege.
B. Principle of most privilege.
C. Principle of effective privilege.
D. Principle of least privilege.
问题 #80
To ensure least privilege requires that __________ is identified.
A. what the users privilege owns
B. what the users job is
C. what the users cost is
D. what the users group is
问题 #81
The concept of least privilege currently exists within the context of:
A. ISO
B. TCSEC
C. OSI
D. IEFT
问题 #82
Which of the following rules is less likely to support the concept of least privilege?
A. The number of administrative accounts should be kept to a minimum
B. Administrators should use regular accounts when performing routing operations like reading mail
C. Permissions on tools that are likely to be used by hackers should be as restrictive as possible
D. Only data to and from critical systems and applications should be allowed through the firewall
问题 #83
Which level of "least privilege" enables operators the right to modify data directly in it's original location, in addition to data copied from the original location?
A. Access Change
B. Read/Write
C. Access Rewrite
D. Access modify
问题 #84
This is a common security issue that is extremely hard to control in large environments. It occurs when a user has more computer rights, permissions, and privileges that what is required for the tasks the user needs to fulfill. What best describes this sc
A. Excessive Rights
B. Excessive Access
C. Excessive Permissions
D. Excessive Privileges
问题 #85
One method to simplify the administration of access controls is to group
A. Capabilities and privileges
B. Objects and subjects
C. Programs and transactions
D. Administrators and managers
问题 #86
Cryptography does not concern itself with:
A. Availability
B. Integrity
C. Confidentiality
D. Authenticity
问题 #87
Which of the following measures would be the BEST deterrent to the theft of corporate information from a laptop which was left in a hotel room?
A. Store all data on disks and lock them in an in-room safe
B. Remove the batteries and power supply from the laptop and store them separately from the computer
C. Install a cable lock on the laptop when it is unattended
D. Encrypt the data on the hard drive
问题 #88
To support legacy applications that rely on risky protocols (e.g,, plain text passwords), which one of the following can be implemented to mitigate the risks on a corporate network?
A. Implement strong centrally generated passwords to control use of the vulnerable applications.
B. Implement a virtual private network (VPN) with controls on workstations joining the VPN.
C. Ensure that only authorized trained users have access to workstations through physical access control.
D. Ensure audit logging is enabled on all hosts and applications with associated frequent log reviews.
问题 #89
Which of the following computer crime is more often associated with insiders?
A. IP spoofing
B. Password sniffing
C. Data diddling
D. Denial of Service (DOS)
问题 #90
The technique of skimming small amounts of money from multiple transactions is called the
A. Scavenger technique
B. Salami technique
C. Synchronous attack technique
D. Leakage technique
问题 #91
What best describes a scenario when an employee has been shaving off pennies from multiple accounts and depositing the funds into his own bank account?
A. Data fiddling
B. Data diddling
C. Salami techniques
D. Trojan horses
问题 #92
What is the act of willfully changing data, using fraudulent input or removal of controls called?
A. Data diddling
B. Data contaminating
C. Data capturing
D. Data trashing
问题 #93
In the context of computer security, "scavenging" refers to searching
A. A user list to find a name.
B. Through storage to acquire information.
C. Through data for information content.
D. Through log files for trusted path information.
问题 #94
Which security program exists if a user accessing low-level data is able to draw conclusions about high-level information?
A. Interference
B. Inference
C. Polyinstatiation
D. Under-classification
问题 #95
Which of the following is not a form of a passive attack?
A. Scavenging
B. Data diddling
C. Shoulder surfing
D. Sniffing
问题 #96
An example of an individual point of verification in a computerized application is
A. An inference check.
B. A boundary protection.
C. A sensitive transaction.
D. A check digit.
问题 #97
Data inference violations can be reduced using
A. Polyinstantiation technique.
B. Rules based meditation.
C. Multi-level data classification.
D. Correct-state transformation.
问题 #98
What is it called when a computer uses more than one CPU in parallel to execute instructions?
A. Multiprocessing
B. Multitasking
C. Multithreading
D. Parallel running
问题 #99
What is the main purpose of undertaking a parallel run of a new system?
A. Resolve any errors in the program and file interfaces
B. Verify that the system provides required business functionality
C. Validate the operation of the new system against its predecessor
D. Provide a backup of the old system
问题 #100
Which of the following provide network redundancy in a local network environment?
A. Mirroring
B. Shadowing
C. Dual backbones
D. Duplexing
问题 #101
A server farm is an example of:
A. Server clustering
B. Redundant servers
C. Multiple servers
D. Server fault tolerance
闽公网安备 35012102500533号
|
闽ICP备18010967号-7