[2023] Practice with these CSSLP dumps Certification Sample Questions [Q40-Q57]

Rate this post

[2023] Practice with these CSSLP dumps Certification Sample Questions

Get Instant Access of 100% REAL CSSLP DUMP Pass Your Exam Easily

QUESTION 40
Which of the following are the responsibilities of the owner with regard to data in an information classification program? Each correct answer represents a complete solution. Choose three.

Reviewing the classification assignments at regular time intervals and making changes as the business needs change.

Running regular backups and routinely testing the validity of the backup data.

Delegating the responsibility of the data protection duties to a custodian.

Determining what level of classification the information requires.

QUESTION 41
Which of the following types of obfuscation transformation increases the difficulty for a de-obfuscation tool so that it cannot extract the true application from the obfuscated version?

Preventive transformation

Data obfuscation

Control obfuscation

Layout obfuscation

QUESTION 42
DoD 8500.2 establishes IA controls for information systems according to the Mission Assurance Categories (MAC) and confidentiality levels. Which of the following MAC levels requires high integrity and medium availability?

MAC III

MAC IV

MAC I

MAC II

QUESTION 43
The National Information Assurance Certification and Accreditation Process (NIACAP) is the minimum standard process for the certification and accreditation of computer and telecommunications systems that handle U.S. national security information. What are the different types of NIACAP accreditation? Each correct answer represents a complete solution. Choose all that apply.

Site accreditation

Type accreditation

Secure accreditation

System accreditation

QUESTION 44
You work as a system engineer for BlueWell Inc. You want to verify that the build meets its data requirements, and correctly generates each expected display and report. Which of the following tests will help you to perform the above task?

Performance test

Functional test

Reliability test

Regression test

QUESTION 45
Which of the following is the process of finding weaknesses in cryptographic algorithms and obtaining the plaintext or key from the ciphertext?

Cryptographer

Cryptography

Kerberos

Cryptanalysis

Explanation:
Cryptanalysis is the process of analyzing cipher text and finding weaknesses in cryptographic algorithms. These weaknesses can be used to decipher the cipher text without knowing the secret key. Answer C is incorrect. Kerberos is an industry standard authentication protocol used to verify user or host identity. Kerberos v5 authentication protocol is the default authentication service for Windows 2000. It is integrated into the administrative and security model, and provides secure communication between Windows 2000 Server domains and clients. Answer A is incorrect. A cryptographer is a person who is involved in cryptography.

QUESTION 46
The LeGrand Vulnerability-Oriented Risk Management method is based on vulnerability analysis and consists of four principle steps. Which of the following processes does the risk assessment step include? Each correct answer represents a part of the solution. Choose all that apply.

Remediation of a particular vulnerability

Cost-benefit examination of countermeasures

Identification of vulnerabilities

Assessment of attacks

QUESTION 47
What are the subordinate tasks of the Initiate and Plan IA C&A phase of the DIACAP process? Each correct answer represents a complete solution. Choose all that apply.

Initiate IA implementation plan

Develop DIACAP strategy

Assign IA controls.

Assemble DIACAP team

Conduct validation activity.

QUESTION 48
John works as a security manager for SoftTech Inc. He is working with his team on the disaster recovery management plan. One of his team members has a doubt related to the most cost effective DRP testing plan. According to you, which of the following disaster recovery testing plans is the most cost-effective and efficient way to identify areas of overlap in the plan before conducting more demanding training exercises?

Full-scale exercise

Walk-through drill

Structured walk-through test

Evacuation drill

QUESTION 49
A security policy is an overall general statement produced by senior management that dictates what role security plays within the organization. Which of the following are required to be addressed in a well designed policy? Each correct answer represents a part of the solution. Choose all that apply.

What is being secured?

Where is the vulnerability, threat, or risk?

Who is expected to exploit the vulnerability?

Who is expected to comply with the policy?

QUESTION 50
Which of the following security models dictates that subjects can only access objects through applications?

Biba model

Bell-LaPadula

Clark-Wilson

Biba-Clark model

QUESTION 51
SIMULATION
Fill in the blank with an appropriate phrase. A is defined as any activity that has an effect on defining, designing, building, or executing a task, requirement, or procedure.

QUESTION 52
There are seven risks responses that a project manager can choose from. Which risk response is appropriate for both positive and negative risk events?

Acceptance

Transference

Sharing

Mitigation

QUESTION 53
Software Development Life Cycle (SDLC) is a logical process used by programmers to develop software. Which of the following SDLC phases meets the audit objectives defined below: System and data are validated. System meets all user requirements. System meets all control requirements.

Evaluation and acceptance

Programming and training

Definition

Initiation

QUESTION 54
You work as a Security Manager for Tech Perfect Inc. The company has a Windows based network. It is required to determine compatibility of the systems with custom applications. Which of the following techniques will you use to accomplish the task?

Safe software storage

Antivirus management

Backup control

Software testing

QUESTION 55
Which of the following specifies access privileges to a collection of resources by using the URL mapping?

Code Access Security

Security constraint

Configuration Management

Access Management

Explanation/Reference:
Explanation: Security constraint is a type of declarative security, which specifies the protection of web content. It also specifies access privileges to a collection of resources by using the URL mapping. A deployment descriptor is used to define the security constraint. Security constraint includes the following elements: Web resource collection Authorization constraint User data constraint Answer: A is incorrect.
Code Access Security (CAS), in the Microsoft .NET framework, is Microsoft’s solution to prevent untrusted code from performing privileged actions. When the CLR (common language runtime) loads an assembly it will obtain evidence for the assembly and use this to identify the code group that the assembly belongs to.
A code group contains a permission set (one or more permissions). Code that performs a privileged action will perform a code access demand, which will cause the CLR to walk up the call stack and examine the permission set granted to the assembly of each method in the call stack. The code groups and permission sets are determined by the administrator of the machine who defines the security policy. Answer: D is incorrect. Access Management is used to grant authorized users the right to use a service, while preventing access to non- authorized users. The Access Management process essentially executes policies defined in IT Security Management. It is sometimes also referred to as Rights Management or Identity Management. It is part of Service Operation and the owner of Access Management is the Access Manager. Access Management is added as a new process to ITIL V3. The sub-processes of Access Management are as follows: Maintain Catalogue of User Roles and Access Profiles Manage User Access Requests Answer: C is incorrect. Configuration Management (CM) is an Information Technology Infrastructure Library (ITIL) IT Service Management (ITSM) process. It tracks all of the individual Configuration Items (CI) in an IT system, which may be as simple as a single server, or as complex as the entire IT department. In large organizations a configuration manager may be appointed to oversee and manage the CM process.

QUESTION 56
Mark works as a Network Administrator for NetTech Inc. The company has a Windows 2000 domain-based network. Users report that they are unable to log on to the network. Mark finds that accounts are locked out due to multiple incorrect log on attempts. What is the most likely cause of the account lockouts?

Spoofing

Brute force attack

SYN attack

PING attack

QUESTION 57
You work as a project manager for BlueWell Inc. You are preparing to plan risk responses for your project with your team. How many risk response types are available for a negative risk event in the project?

Three

Seven

One

Four

Secure Software Implementation (14%):

Securely reuse 3rd-party libraries or code;
Evaluate code for various security risks – It requires the individuals’ skills in securing code reuse, dynamics application security testing, interactive application security testing, manual code review, static application security testing, and vulnerability list/databases;
Hold on to the appropriate secure coding practices – This subsection covers declarative vs. imperative, output sanitization, session management, concurrency, input validation, secure auditing & logging, secure configuration management, isolation, tokenizing, cryptography, and access control, among others;
Implement security controls;
Apply security in the course of building processes.

Free Exam Files Downloaded Instantly: https://www.free4dump.com/CSSLP-braindumps-torrent.html

Secure Software Implementation (14%):

You may also like

Leave a Reply Cancel reply