All of the following are basic components of a security policy EXCEPT the
A. definition of the issue and statement of relevant terms.
B. statement of roles and responsibilities
C. statement of applicability and compliance requirements.
D. statement of performance of characteristics and requirements.
Policies are considered the first and highest level of documentation, from which the lower level
elements of standards, procedures, and guidelines flow. This order, however, does not mean that
policies are more important than the lower elements. These higher-level policies, which are the
more general policies and statements, should be created first in the process for strategic reasons,
and then the more tactical elements can follow. -Ronald Krutz The CISSP PREP Guide (gold
edition) pg 13
A security policy would include all of the following EXCEPT
B. Scope statement
C. Audit requirements
Which one of the following is an important characteristic of an information security policy?
A. Identifies major functional areas of information.
B. Quantifies the effect of the loss of the information.
C. Requires the identification of information owners.
D. Lists applications that support the business function.
Information security policies area high-level plans that describe the goals of the procedures.
Policies are not guidelines or standards, nor are they procedures or controls. Policies describe
security in general terms, not specifics. They provide the blueprints for an overall security
program just as a specification defines your next product – Roberta Bragg CISSP Certification
Training Guide (que) pg 206
Ensuring the integrity of business information is the PRIMARY concern of
A. Encryption Security
B. Procedural Security.
C. Logical Security
D. On-line Security
Procedures are looked at as the lowest level in the policy chain because they are closest to the
computers and provide detailed steps for configuration and installation issues. They provide the
steps to actually implement the statements in the policies, standards, and guidelines…Security
procedures, standards, measures, practices, and policies cover a number of different subject
areas. – Shon Harris All-in-one CISSP Certification Guide pg 44-45
Which of the following would be the first step in establishing an information security
A. Adoption of a corporate information security policy statement
B. Development and implementation of an information security standards manual
C. Development of a security awareness-training program
D. Purchase of security access control software
Which of the following department managers would be best suited to oversee the
development of an information security policy?
A. Information Systems
B. Human Resources
C. Business operations
D. Security administration
What is the function of a corporate information security policy?
A. Issue corporate standard to be used when addressing specific security problems.
B. Issue guidelines in selecting equipment, configuration, design, and secure operations.
C. Define the specific assets to be protected and identify the specific tasks which must be completed to secure
D. Define the main security objectives which must be achieved and the security framework to meet business
Information security policies are high-level plans that describe the goals of the procedures or
controls. Policies describe security in general, not specifics. They provide the blueprint fro an
overall security program just as a specification defines your next product. – Roberta Bragg
CISSP Certification Training Guide (que) pg 587
Why must senior management endorse a security policy?
A. So that they will accept ownership for security within the organization.
B. So that employees will follow the policy directives.
C. So that external bodies will recognize the organizations commitment to security.
D. So that they can be held legally accountable.
This really does not a reference as it should be known. Upper management is legally accountable (up to 290
fine). External organizations answer is not really to pertinent (however it stated that other organizations will
a BCP and disaster recover plan). Employees need to be bound to the policy regardless of who signs it but it
validity. Ownership is the correct answer in this statement. However, here is a reference. “Fundamentally
to any security program’s success us the senior management’s high-level statement of commitment to the
information security policy process and a senior management’s understanding of how important security
and protections are to the enterprise’s continuity. Senior management must be aware of the importance of
implementation to preserve the organization’s viability (and for their own ‘due care’ protection) and must
support that process throughout the enterprise.” -Ronald Krutz The CISSP PREP Guide (gold edition) pg
In which one of the following documents is the assignment of individual roles and
responsibilities MOST appropriately defined?
A. Security policy
B. Enforcement guidelines
C. Acceptable use policy
D. Program manual
An acceptable use policy is a document that the employee signs in which the expectations, roles
and responsibilities are outlined.
Issue -specific policies address specific security issues that management feels need more detailed
explanation and attention to make sure a comprehensive structure is built and all employees
understand how they are to comply to these security issues. – Shon Harris All-in-one CISSP
Certification Guide pg 62
Which of the following defines the intent of a system security policy?
A. A definition of the particular settings that have been determined to provide optimum security.
B. A brief, high-level statement defining what is and is not permitted during the operation of the system.
C. A definition of those items that must be excluded on the system.
D. A listing of tools and applications that will be used to protect the system.
“A system-specific policy presents the management’s decisions that are closer to the actual computers,
applications, and data. This type of policy can provide an approved software list, which contains a list of
applications that can be installed on individual workstations. This policy can describe how databases are to be
protected, how computers are to be locked down, and how firewall, intrusion diction systems, and scanners are
employed.” Pg 93 Shon Harris CISSP All-In-One Certification Exam Guide
When developing an information security policy, what is the FIRST step that should be taken?
A. Obtain copies of mandatory regulations.
B. Gain management approval.
C. Seek acceptance from other departments.
D. Ensure policy is compliant with current working practices.
Which one of the following should NOT be contained within a computer policy?
A. Definition of management expectations.
B. Responsibilities of individuals and groups for protected information.
C. Statement of senior executive support.
D. Definition of legal and regulatory controls.
Which one of the following is NOT a fundamental component of a Regulatory Security Policy?
A. What is to be done.
B. When it is to be done.
C. Who is to do it.
D. Why is it to be done
Regulatory Security policies are mandated to the organization but it up to them to implement it.
“Regulatory – This policy is written to ensure that the organization is following standards set by
a specific industry and is regulated by law. The policy type is detailed in nature and specific to a
type of industry. This is used in financial institutions, health care facilities, and public utilities.” –
Shon Harris All-in-one CISSP Certification Guide pg 93-94
Which one of the following statements describes management controls that are instituted to
implement a security policy?
A. They prevent users from accessing any control function.
B. They eliminate the need for most auditing functions.
C. They may be administrative, procedural, or technical.
D. They are generally inexpensive to implement.
Administrative, physical, and technical controls should be utilized to achieve the management’s
directives. – Shon Harris All-in-one CISSP Certification Guide pg 60
Which must bear the primary responsibility for determining the level of protection needed
for information systems resources?
A. IS security specialists
B. Senior Management
C. Seniors security analysts
D. system auditors
Which of the following choices is NOT part of a security policy?
A. definition of overall steps of information security and the importance of security
B. statement of management intend, supporting the goals and principles of information security
C. definition of general and specific responsibilities for information security management
D. description of specific technologies used in the field of information security
In an organization, an Information Technology security function should:
A. Be a function within the information systems functions of an organization
B. Report directly to a specialized business unit such as legal, corporate security or insurance
C. Be lead by a Chief Security Officer and report directly to the CEO
D. Be independent but report to the Information Systems function
Which of the following embodies all the detailed actions that personnel are required to
A significant action has a state that enables actions on an ADP system to be traced to individuals
who may then be held responsible. The action does NOT include:
A. Violations of security policy.
B. Attempted violations of security policy.
C. Non-violations of security policy.
D. Attempted violations of allowed actions.
Significant action: The quality or state that enables actions on an ADP system to be
traced to individuals who may then be held responsible. These actions include
violations and attempted violations of the security policy, as well as allowed actions.
Network Security is a
C. ever evolving process
D. quick-fix solution
Security is a process that is:
Security is a continuous process; as such you must closely monitor your systems on a
regular basis. Log files are usually a good way to find an indication of abnormal
activities. However some care must be exercise as to what will be logged and how the
logs are protected. Having corrupted logs is about as good as not having logs at all.
What are the three fundamental principles of security?
A. Accountability, confidentiality, and integrity
B. Confidentiality, integrity, and availability
C. Integrity, availability, and accountability
D. Availability, accountability, and confidentiality
Which of the following prevents, detects, and corrects errors so that the integrity,
availability, and confidentiality of transactions over networks may be maintained?
A. Communications security management and techniques
B. Networks security management and techniques
C. Clients security management and techniques
D. Servers security management and techniques
Making sure that the data is accessible when and where it is needed is which of the
Which of the following describes elements that create reliability and stability in networks
and systems and which assures that connectivity is accessible when needed?
Most computer attacks result in violation of which of the following security properties?
C. Integrity and control
D. All of the choices.
Most computer attacks only corrupt a system’s security in very specific ways. For
example, certain attacks may enable a hacker to read specific files but don’t allow
alteration of any system components. Another attack may allow a hacker to shut down
certain system components but doesn’t allow access to any files. Despite the varied
capabilities of computer attacks, they usually result in violation of only four
different security properties: availability, confidentiality, integrity, and control.
Which of the following are objectives of an information systems security program?
A. Threats, vulnerabilities, and risks
B. Security, information value, and threats
C. Integrity, confidentiality, and availability.
D. Authenticity, vulnerabilities, and costs.
There are several small and large objectives of a security program, but the main three principles
in all programs are confidentiality, integrity, and availability. These are referred to as the CIA
triad. – Shon Harris All-in-one CISSP Certification Guide pg 62
An area of the Telecommunications and Network Security domain that directly affects the
Information Systems Security tenet of Availability can be defined as:
A. Netware availability
B. Network availability
C. Network acceptability
D. Network accountability
The Structures, transmission methods, transport formats, and security measures that are
used to provide integrity, availability, and authentication, and confidentiality for
transmissions over private and public communications networks and media includes:
A. The Telecommunications and Network Security domain
B. The Telecommunications and Netware Security domain
C. The Technical communications and Network Security domain
D. The Telnet and Security domain
The Telecommunications, Network, and Internet Security Domain encompasses the structures,
transmission methods, transport formats, and security measures used to provide integrity,
availability, authentication, and confidentiality for transmissions over private and public
communications networks and media.” Pg 515 Hansche: Official (ISC)2 Guide to the CISSP
Which one of the following is the MOST crucial link in the computer security chain?
A. Access controls
D. Awareness programs
The security planning process must define how security will be managed, who will be
A. Who practices are reasonable and prudent for the enterprise.
B. Who will work in the security department.
C. What impact security will have on the intrinsic value of data.
D. How security measures will be tested for effectiveness.
Information security is the protection of data. Information will be protected mainly based
A. Its sensitivity to the company.
B. Its confidentiality.
C. Its value.
D. All of the choices.
Information security is the protection of data against accidental or malicious
disclosure, modification, or destruction. Information will be protected based on its
value, confidentiality, and/or sensitivity to the company, and the risk of loss or
compromise. At a minimum, information will be update-protected so that only authorized
individuals can modify or erase the information.
Organizations develop change control procedures to ensure that
A. All changes are authorized, tested, and recorded.
B. Changes are controlled by the Policy Control Board (PCB).
C. All changes are requested, scheduled, and completed on time.
D. Management is advised of changes made to systems.
“Change Control: Changes must be authorized, tested, and recorded. Changed systems may
require re-certification and re-accreditation.” Pg 699 Shon Harris: All-in-One CISSP
Within the organizational environment, the security function should report to an organizational level that
A. Has information technology oversight.
B. Has autonomy from other levels.
C. Is an external operation.
D. Provides the internal audit function.
What is the MAIN purpose of a change control/management system?
A. Notify all interested parties of the completion of the change.
B. Ensure that the change meets user specifications.
C. Document the change for audit and management review.
D. Ensure the orderly processing of a change request.
Which of the following is most relevant to determining the maximum effective cost of
A. the value of information that is protected
B. management’s perceptions regarding data importance
C. budget planning related to base versus incremental spending.
D. the cost to replace lost data
Which one of the following is the MAIN goal of a security awareness program when addressing senior
A. Provide a vehicle for communicating security procedures.
B. Provide a clear understanding of potential risk and exposure.
C. Provide a forum for disclosing exposure and risk analysis.
D. Provide a forum to communicate user responsibilities.
When the Security Officer is addressing Senior Management, the focus would not be on
user responsibilities, it would be on making sure the Senior Management have a clear
understanding of the risk and potential liability is
Not D: Item D would be correct in a situation where Senior Management is addressing
In developing a security awareness program, it is MOST important to
A. Understand the corporate culture and how it will affect security.
B. Understand employees preferences for information security.
C. Know what security awareness products are available.
D. Identify weakness in line management support.
The controls and procedures of a security program should reflect the nature of the data being processed…These
different types of companies would also have very different cultures. For a security awareness program to be
effective, these considerations must be understood and the program should be developed in a fashion that makes
sense per environment – Shon Harris All-in-one CISSP Certification Guide pg 109
Which of the following would be best suited to provide information during a review of the
controls over the process of defining IT service levels?
A. Systems programmer
B. Legal stuff
C. Business unit manager
Which of the following best explains why computerized information systems frequently fail
to meet the needs of users?
A. Inadequate quality assurance (QA) tools
B. Constantly changing user needs
C. Inadequate user participation in defining the system’s requirements
D. Inadequate project management.
Which of the following is not a compensating measure for access violations?
B. Business continuity planning
D. Security awareness
Risk analysis is MOST useful when applied during which phase of the system development
A. Project identification
B. Requirements definition
C. System construction
D. Implementation planning
Reference: pg 684 Shon Harris: All-in-One CISSP Certification
Which one of the following is not one of the outcomes of a vulnerability analysis?
A. Quantative loss assessment
B. Qualitative loss assessment
C. Formal approval of BCP scope and initiation document
D. Defining critical support areas
Which of the following is not a part of risk analysis?
A. Identify risks
B. Quantify the impact of potential threats
C. Provide an economic balance between the impact of the risk and the cost of the associated
D. Choose the best countermeasure
A new worm has been released on the Internet. After investigation, you have not been able to determine if
you are at risk of exposure. Management is concerned as they have heard that a number of their
counterparts are being affected by the worm. How could you determine if you are at risk?
A. Evaluate evolving environment.
B. Contact your anti-virus vendor.
C. Discuss threat with a peer in another organization.
D. Wait for notification from an anti-virus vendor.
When conducting a risk assessment, which one of the following is NOT an acceptable social engineering
A. Shoulder surfing
D. Dumpster diving
Shoulder Surfing: Attackers can thwart confidentiality mechanisms by network
monitoring, shoulder surfing, stealing password files, and social engineering. These
topics will be address more in-depth in later chapters, but shoulder surfing is when a
person looks over another person’s shoulder and watches keystrokes or data as it appears
on the screen. Social engineering is tricking another person into sharing confidential
information by posing as an authorized individual to that information. Shon Harris:
CISSP Certification pg. 63. Shoulder surfing is not social engineering.
Which one of the following risk analysis terms characterizes the absence or weakness of a
D. Loss expectancy
A weakness in system security procedures, system design, implementation, internal controls, and
so on that could be exploited to violate system security policy. -Ronald Krutz The CISSP PREP
Guide (gold edition) pg 927
Risk is commonly expressed as a function of the
A. Systems vulnerabilities and the cost to mitigate.
B. Types of countermeasures needed and the system’s vulnerabilities.
C. Likelihood that the harm will occur and its potential impact.
D. Computer system-related assets and their costs.
The likelihood of a threat agent taking advantage of a vulnerability. A risk is the loss potential,
or probability, that a threat will exploit a vulnerability. – Shon Harris All-in-one CISSP
Certification Guide pg 937
How should a risk be handled when the cost of the countermeasures outweighs the cost of
A. Reject the risk
B. Perform another risk analysis
C. Accept the risk
D. Reduce the risk
Which of the following is an advantage of a qualitative over quantitative risk analysis?
A. It prioritizes the risks and identifies areas for immediate improvement in addressing
B. It provides specific quantifiable measurements of the magnitude of the impacts
C. It makes cost-benefit analysis of recommended controls easier
The absence or weakness in a system that may possibly be exploited is called a(n)?
What tool do you use to determine whether a host is vulnerable to known attacks?
A. Padded Cells
B. Vulnerability analysis
C. Honey Pots
Vulnerability analysis (also known as vulnerability assessment) tools test to determine
whether a network or host is vulnerable to known attacks. Vulnerability assessment
represents a special case of the intrusion detection process. The information sources
used are system state attributes and outcomes of attempted attacks. The information
sources are collected by a part of the assessment engine. The timing of analysis is
interval-based or batch-mode, and the type of analysis is misuse detection. This means
that vulnerability assessment systems are essentially batch mode misuse detectors that
operate on system state information and results of specified test routines.
Which of the following statements pertaining to ethical hacking is incorrect?
A. An organization should use ethical hackers who do not sell auditing, consulting, hardware,
software, firewall, hosting, and/or networking services
B. Testing should be done remotely
C. Ethical hacking should not involve writing to or modifying the target systems
D. Ethical hackers should never use tools that have potential of exploiting vulnerabilities in the
organizations IT system.
Why would an information security policy require that communications test equipment be
A. The equipment is susceptible to damage
B. The equipment can be used to browse information passing on a network
C. The equipment must always be available for replacement if necessary
D. The equipment can be used to reconfigure the network multiplexers
Management can expect penetration tests to provide all of the following EXCEPT
A. identification of security flaws
B. demonstration of the effects of the flaws
C. a method to correct the security flaws.
D. verification of the levels of existing infiltration resistance
Not B: It is not the objective of the pen tester to supply a method on how to correct the
flaws. In fact management may decide to accept the risk and not repair the flaw. They
may be able to demonstrate the effects of a flaw – especially if they manage to clobber a
Penetration testing is a set of procedures designed to test and possibly bypass security
controls of a system. Its goal is to measure an organization’s resistance to an attack and to
uncover any weaknesses within the environment…The result of a penetration test is a
report given to management describing the list of vulnerabilities that were identified and
the severity of those vulnerabilities. From here, it is up to management to determine how
the vulnerabilities are dealt with and what countermeasures are implemented. – Shon
Harris All-in-one CISSP Certification Guide pg 837-839
Which one of the following is a characteristic of a penetration testing project?
A. The project is open-ended until all known vulnerabilities are identified.
B. The project schedule is plotted to produce a critical path.
C. The project tasks are to break into a targeted system.
D. The project plan is reviewed with the target audience.
“One common method to test the strength of your security measures is to perform penetration
testing. Penetration testing is a vigorous attempt to break into a protected network using any
means necessary.” Pg 430 Tittel: CISSP Study Guide
Which one of the following is the PRIMARY objective of penetration testing?
Its goal is to measure an organization’s resistance to an attack and to uncover any weakness within the
environment…The result of a penetration test is a report given to management describing the list of
vulnerabilities that were identified and the severity of those vulnerabilities. – Shon Harris All-in-one CISSP
Certification Guide pg 837-839
Not A: Assessment would imply management deciding whether they can live with a given
Open box testing, in the Flaw Hypothesis Methodology of Penetration Testing applies to the analysis of
A. Routers and firewalls
B. Host-based IDS systems
C. Network-based IDS systems
D. General purpose operating systems
Flaw Hypothesis Methodology – A system analysis and penetration technique where
specifications and documentation for the system are analyzed and then flaws in the system are
hypothesized. The list of hypothesized flaws is then prioritized on the basis of the estimated
probability that a flaw actually exists and, assuming a flaw does exist, on the ease of exploiting it
and on the extent of control or compromise it would provide. The prioritized list is used to direct
the actual testing of the system.
What is the FIRST step that should be considered in a penetration test?
A. The approval of change control management.
B. The development of a detailed test plan.
C. The formulation of specific management objectives.
D. The communication process among team members.
The type of penetration test depends on the organization, its security objectives, and the
management’s goals. – Shon Harris All-in-one CISSP Certification Guide pg 838
Penetration testing will typically include
A. Generally accepted auditing practices.
B. Review of Public Key Infrastructure (PKI) digital certificate, and encryption.
C. Social engineering, configuration review, and vulnerability assessment.
D. Computer Emergency Response Team (CERT) procedures.
Which of the following is not a valid reason to use external penetration service firms rather
than corporate resources?
A. They are more cost-effective
B. They offer a lack of corporate bias
C. They use highly talented ex-hackers
D. They insure a more complete reporting
Which of the following tools can you use to assess your networks vulnerability?
B. All of the choices.
ISS, Ballista and SATAN are all penetration tools.
Annualized Loss Expectancy (ALE) value is derived from an algorithm of the product of annual rate of
A. Cost of all losses expected.
B. Previous year’s actual loss.
C. Average of previous losses.
D. Single loss expectancy.
Single Loss Expectancy (SLE) x Annualized Rate of Occurance (ARO) = ALE pg. 18 Krutz: The CISSP Prep
If your property insurance has Actual Cost Evaluation (ACV) clause your damaged
property will be compensated:
A. Based on the value of the item on the date of loss
B. Based on new item for old regardless of condition of lost item
C. Based on value of item one month before loss
D. Based on value of item on the date of loss plus 10 percent
How is Annualized Loss Expectancy (ALE) derived from a threat?
A. ARO x (SLE – EF)
B. SLE x ARO
D. AV x EF
“SLE x annualized rate of occurrence (ARO) = ALE” pg 70 Shon Harris: All-in-One CISSP
Qualitative loss resulting from the business interruption does not include:
A. Loss of revenue
B. Loss of competitive advantage or market share
C. Loss of public confidence and credibility
D. Public embarrassment
“Another method of risk analysis is qualitative, which does not assign numbers and monetary
valu8es to components and losses.” Pg 72 Shon Harris: All-in-One CISSP Certification
Which risk management methodology uses the exposure factor multiplied by the asset value to determine its
A. Annualized Loss Expectancy
B. Single Loss Expectancy
C. Annualized Rate of Occurrence
D. Information Risk Management
Single Loss Expectancy (SLE) AN SLE is the dollar figure that is assigned to a single event. It
represents an organization’s loss from a single threat and is derived from the following formula:
Asset Value ($) X Exposure Factor (EF) = SLE -Ronald Krutz The CISSP PREP Guide (gold
edition) pg 18
Valuable paper insurance coverage does not cover damage to which of the following?
A. Inscribed, printed and written documents
D. Money and Securities
What is the window of time for recovery of information processing capabilities based on?
A. Quality of the data to be processed
B. Nature of the disaster
C. Criticality of the operations affected
D. Applications that are mainframe based