CISSP Questions – Volume 07 – 1401-1453 Questions

QUESTION 1401: 
Why is fiber the most secure means of transmission? 
A. High speed multiplexing 
B. Interception of traffic is more difficult because it is optically based 
C. Higher data rates make it more secure 
D. Multiplexing prevents traffic analysis 
E. Built-in fault tolerance 
Answer: B 
Fiber is more secure because it is hard to tap into and gives off no EMI such as copper cabling. 
QUESTION 1402: 
The IAB defines which of the following as a violation of ethics? 
A. Performing a DoS 
B. Downloading an active control 
C. Performing a penetration test 
D. Creating a virus 
E. Disrupting Internet communications 
Answer: E 
The IAAB considers the Internet a privilege, not a right, and as such considers it unethical to 
purposely disrupt communications. 
QUESTION 1403: 
A chain of custody shows who ______ _________ and _________.(Choose three) 
A. Who controlled the evidence 
B. Who transcribed the evidence 
C. Who validated the evidence 
D. Who presented the evidence 
E. Secured the evidence 
F. Obtained the evidence 
Answer: A,E,F 
The chain of evidence shows who obtained the evidence, who secured the evidence, and who 
controlled the evidence. 
QUESTION 1404: 
Good forensics requires the use of a bit level copy?(True/False) 
A. True 
B. False 
Answer: A 
Good forensics requires the use of a bit level copy. A bit level copy duplicates all information on 
the suspect's disk. This includes slack space and free space. 
QUESTION 1405: 
Which agency shares the task of investigating computer crime along with the FBI? 
A. Secret Service 
B. CIA 
C. Department of justice 
D. Police force 
E. NSA 
Answer: A 
Along with the FBI, the Secret Service has been given the authority to investigate computer 
crime. 
QUESTION 1406: 
This type of password recovery is considered more difficult and must work through all 
possible combinations of numbers and characters. 
A. Passive 
B. Active 
C. Dictionary 
D. Brute force 
E. Hybrid 
Answer: D 
Brute force cracking is considered more difficult and must work through all possible 
combinations of numbers and characters. 
QUESTION 1407: 
_______ are added to Linux passwords to increase their randomness. 
A. Salts 
B. Pepper 
C. Grains 
D. MD5 hashes 
E. Asymmetric algorithms 
Answer: A 
Salts are added to Linux passwords to increase their randomness. They are used to help insure 
that no two users have the same, hashed password. 
QUESTION 1408: 
The Linux root user password is typically kept in where?(Choose two) 
A. etc/shadow 
B. cmd/passwd 
C. etc/passwd 
D. windows/system32 
E. var/sys 
F. var/password 
Answer: A,C 
The Linux root user password is typically kept in /etc/passwd or etc/shadow. 
QUESTION 1409: 
The goal of cryptanalysis is to ____________. 
A. Determine the number of encryption permutations required 
B. Reduce the system overhead for a crypto-system 
C. Choose the correct algorithm for a specified purpose 
D. Forge coded signals that will be accepted as authentic 
E. Develop secure crypto-systems 
Answer: D 
The goal of cryptanalysis is to forge coded signals that will be accepted as authentic. 
QUESTION 1410: 
If an employee is suspected of computer crime and evidence need to be collected, which of 
the following departments must be involved with the procedure? 
A. Public relations 
B. Law enforcement 
C. Computer security 
D. Auditing 
E. HR 
Answer: E 
Human Resources always needs to be involved if an employee is suspected of wrongdoing. They 
know what rules apply to protect and prosecute employees. 
QUESTION 1411: 
What is it called when a system has apparent flaws that were deliberately available for 
penetration and exploitation? 
A. A jail 
B. Investigation 
C. Enticement 
D. Data manipulation 
E. Trapping 
Answer: C 
Administrators that leave systems with apparent flaws are performing an act of enticement. This 
is sometimes called a honeypot. 
QUESTION 1412: 
Why are computer generated documents not considered reliable? 
A. Difficult to detect electron tampering 
B. Stored in volatile media 
C. Unable to capture and reproduce 
D. Too delicate 
E. Because of US law, Section 7 paragraph 154 
Answer: A 
Because it is difficult to detect electron tampering and can be easily modified. 
QUESTION 1413: 
What is the name of the software that prevents users from seeing all items or directories on 
a computer and is most commonly found in the UNIX/Linux environment? 
A. Shell Kits 
B. Root Kits 
C. Ethereal 
D. Shadow data 
E. Netbus 
Answer: D 
QUESTION 1414: 
What is a commercial application of steganography that is used to identify pictures or 
verify their authenticity? 
A. A MAC 
B. A digital checksum 
C. A MD5 hash 
D. A digital signature 
E. A watermark 
Answer: E 
A watermark is a commercial application of steganography that is used to identify pictures or 
verify its authenticity. 
QUESTION 1415: 
What are the basic questions that must be asked at the beginning of any 
investigation?(Choose all that apply) 
A. Who 
B. Cost 
C. What 
D. When 
E. Where 
F. How 
G. Time frame 
H. Budget 
Answer: A,C,D,E,F 
At the beginning of any investigation, an investigator must ask who, what, when, where, and 
how. Answering the questions will lead to the successful conclusion of the case. 
QUESTION 1416: 
Risk can be eliminated.(True/False) 
A. True 
B. False 
Answer: B 
Risk can never be eliminated. It may be reduced or transferred to a third party through insurance, 
but will always remain in some form. 
QUESTION 1417:
Employees are a greater risk to employers than outsiders. T/F(True/False) 
A. True 
B. False 
Answer: A 
Employees are a greater risk to employers than outsiders, because they possess two of the three 
items required to commit a crime: means and opportunity. 
QUESTION 1418: 
What does the term "red boxing" mean? 
A. Denial of Service 
B. Telephone voltage manipulation 
C. Sounds of coins dropping 
D. Tone manipulation 
E. A salami attack 
Answer: C 
Red boxing was used by phone phreakers to record the sound off coins dropping in pay phones 
and play it back to gain free phone access. 
QUESTION 1419: 
Which of the following is the proper lifecycle of evidence? 
A. A Collection, storage, present in court, destroy 
B. Collection, transportation, storage, return to owner 
C. Collection, present in court, transportation, return to owner 
D. Collection, analysis, storage, present in court, return to owner 
E. Collection, storage, transportation, present in court, return to owner 
Answer: D 
The life cycle of evidence includes: collection, analysis, storage, present in court, and return to 
owner 
QUESTION 1420: 
A copy of a computer disk would be what type of evidence? 
A. Secondary 
B. Best 
C. Hearsay 
D. Direct 
E. Indirect 
Answer: C 
A copy of a computer disk is considered hearsay, because unless it has been copied in a 
forensically approved manner, it is not credible evidence. 
QUESTION 1421: 
A copyright protects _________. 
A. The trade secrets of a company 
B. A persons private papers 
C. An invention 
D. An expression or an idea 
E. Distinguishing or unique characters, colors, or words 
Answer: D 
A copyright protects the expression of a resource, not the resource directly. 
QUESTION 1422: 
________ is a ________ attack that eavesdrops on communication. (Choose two) 
A. Passive 
B. Active 
C. Brute force 
D. Wiretapping 
E. Password cracking 
Answer: A,D 
Wiretapping is a passive attack that eavesdrops on communication. It is only legal with prior 
consent or a warrant. 
QUESTION 1423: 
What types of laws are considered standards of performance or conduct expected by 
government agencies from companies, industries, and certain officials.(Chose all that 
apply) 
A. Civil 
B. Criminal 
C. Administrative 
D. Regulatory 
E. Tort 
Answer: C,D 
Administrative or regulatory laws are considered standards of performance or conduct expected 
by government agencies from companies, industries, and certain officials. 
QUESTION 1424: 
Sandra's employer is considering placing login banners on all company computers to 
indicate to the users about the permitted use of company computers. What is this called? 
A. Employee privacy law 
B. Employee policies 
C. Employee regulations 
D. User policies 
E. Acceptable use policy 
Answer: E 
Acceptable use policies provide the company with legal protection. Logon banners should be 
used to inform users what will happen if they do not follow company rules. 
QUESTION 1425: 
________ deemed proprietary to a company and can be information that provides a 
competitive edge. 
A. Trade secrets are 
B. Copyrights are 
C. Restricted information is 
D. Information marked strictly private is 
Answer: A 
Trade secrets are deemed proprietary to a company and can be information that provides a 
competitive edge. This information is protected as long as the owner takes the necessary security 
actions. 
QUESTION 1426: 
Sandra is studying for her CISSP exam. Sandra has come to you for help and wants to 
know what the last step in the change control process is? 
A. Validated and approved 
B. Test and implement 
C. Review and approve 
D. Report change to management 
E. Inform user of change 
Answer: D 
Reporting the change to management is the last step in the process. 
QUESTION 1427: 
Who is ultimately responsible for the security of an organization? 
A. Management 
B. Senior management 
C. The chief security officer 
D. Department heads 
E. Employees 
Answer: B 
Senior management is ultimately responsible for the security of an organization. Policy flows 
from the top down. 
QUESTION 1428: 
Which of the following falls under the categories of configuration management?(Choose 
three) 
A. Operating system configuration 
B. Software configuration 
C. Hardware configuration 
D. Logical configuration 
E. Physical configuration 
Answer: A,B,C 
Configuration management controls the changes that take place in hardware, software, and 
operating systems. 
QUESTION 1429: 
Macro viruses infect what type of files. 
A. Microsoft office files 
B. Mail servers 
C. E-mail messages 
D. Web browsers 
E. Linux Kernel files 
Answer: A 
Macro viruses infect Microsoft office files. There are many macro viruses because the macro 
language is easy to use and because Microsoft Office is prolific. 
QUESTION 1430: 
What is another name for rows and columns within relational databases?(Choose two) 
A. Attributes 
B. Keys 
C. Tuples 
D. Views 
E. Attributes 
Answer: C,E 
Within a relational database, the rows of a table are called tuples and the columns are called 
attributes. 
QUESTION 1431: 
Which of the following can reproduce itself without the help of system applications or 
resources? 
A. Trojan 
B. Logic bomb 
C. Virus 
D. Worm 
E. Backdoor 
Answer: D 
Worms can reproduce themselves without the help of system applications or resources. 
QUESTION 1432: 
What is the final stage of the system development life cycle? 
A. Certification 
B. Validation 
C. Evaluation 
D. Implementation 
E. Maintenance 
F. Installation 
Answer: E 
Maintenance is the final stage of the system development life cycle. 
QUESTION 1433: 
A polymorphic virus is _____________. 
A. A virus that makes copies of itself and then makes changes to those copies 
B. A virus that can make itself stealth 
C. A virus that is written in a macro language 
D. A virus that is written in visual basic 
E. A virus that infects the boot sector of a hard drive 
Answer: A 
A polymorphic virus is a virus that makes copies of itself, then makes changes to those copies. It 
does this in hopes of avoiding detection of anti-virus software. 
QUESTION 1434: 
Which one of the following is identified by a business impact analysis?(Choose three) 
A. Determining regulatory requirements 
B. Analyzing the threats associated with each functional area 
C. Determining the risk associated with each threat 
D. Identifying the major functional areas of information 
E. Determining the team members that will be associated with disaster planning 
Answer: B,C,D 
The following identifies a business impact analysis: analyzing the threats associated with each 
functional area, determining the risk associated with each threat, and identifying the major 
functional areas of information. 
QUESTION 1435: 
_______ are the step-by-step instructions used to satisfy control requirements. 
A. Policy 
B. Procedure 
C. Guideline 
D. Standard 
E. Outline 
Answer: B 
Procedures are the step-by-step instructions used to satisfy control requirements. 
QUESTION 1436: 
Which of the following are controls that can be used to secure faxing of sensitive 
data?(Choose all that apply) 
A. Disable automatic printing 
B. Print "sensitive document banner" on each page 
C. Fax encryptor 
D. Send to email boxes instead of printing 
E. Restrict the use of fax machines that use a ribbon or duplication cartridge 
Answer: A,C,D,E 
All of the items listed can help secure faxes except printing a sensitive document banner, 
which actually encourages people to look at the document. 
QUESTION 1437: 
Which of the following are considered administrative controls?(Choose all that apply) 
A. Rotation of duties 
B. Separation of duties 
C. Implementation of WEP keys 
D. Enforcing mandatory vacations 
Answer: A,B,D 
Rotation of duties, separation of duties, and mandatory vacations are all administrative controls, 
enforcing WEP is a technical control 
QUESTION 1438: 
Why should organizations enforce separation of duties? 
A. It ensures compliance with federal union rules 
B. It helps verify that all employees know their job tasks 
C. It provides for a better work environment 
D. It encourages collusion 
E. It is considered valuable in deterring fraud 
Answer: E 
Separation of duties is considered valuable in deterring fraud since fraud can occur if an 
opportunity exists for collaboration between various job related capabilities. The most 
commonly used examples are the separate transactions needed to initiate a payment and to 
authorize a payment. No single individual should be capable of executing both transactions.
QUESTION 1439: 
What is the most secure way to dispose of data held on a CD? 
A. Reformatting 
B. Sanitizing 
C. Physical destruction 
D. Degaussing 
Answer: C 
Since CD's cannot be sanitized in a way to remove all data, they should be physically destroyed. 
There are many products that con do this. Some actually shred the CD! 
QUESTION 1440: 
What is the most accepted way to dispose data held on a floppy disk? 
A. Reformatting 
B. Sanitizing 
C. Physical destruction 
D. Degaussing 
Answer: D 
Degaussing is the most accepted way of disposing data held on a floppy disk. 
QUESTION 1441: 
Which of the following is NOT an attack against operations? 
A. Morris Worm 
B. SYN Denial of Service 
C. Buffer Overflow 
D. Brute force 
E. Known plain text attack 
Answer: E 
A known plain text attack is an attack against the organization's cryptosystem, not a direct attack 
against operations. 
QUESTION 1442: 
Which one of the following tools can be used to launch a Distributed Denial of service 
attack against a network? 
A. Satan 
B. Saint 
C. Trinoo 
D. Nmap 
E. Netcat 
Answer: C 
Trinoo and the Tribal Flood Network (TFN) are the two most commonly used distributed denial 
of service attacks. The other four tools mentioned are reconnaissance techniques used to map 
networks and scan for known vulnerabilities. 
QUESTION 1443: 
Which one of the following network attacks takes advantages of weaknesses in the 
fragment reassembly functionality of the TCP/IP protocol stack? 
A. Teardrop 
B. Smurf 
C. Ping of Death 
D. SYN flood 
E. SNMP Attack 
Answer: A 
The teardrop attack uses overlapping packet fragments to confuse a target system and cause the 
system to reboot or crash. 
QUESTION 1444: 
What are the elements of the CIA triad?(Choose three) 
A. Confidentiality 
B. Accountability 
C. Accessibility 
D. Integrity 
E. Interest 
F. Control 
G. Availability 
Answer: A,D,G 
The essential security principles of confidentiality, integrity, and availability are referred to as 
the CIA Triad. 
QUESTION 1445: 
____________ is the first step of access control. 
A. Identification 
B. Authorization 
C. Validation 
D. Interrogation 
E. Accountability logging 
Answer: A 
The first step in the access control process is identifying who the subject is. 
QUESTION 1446: 
What is a Type 2 authentication factor? 
A. Something you know 
B. Something you are 
C. Something you have 
Answer: C 
A Type 2 authentication factor is something you have, such as a smart card, ATM card, token 
device, memory card, etc. 
QUESTION 1447: 
_______ requires that two entities work together to complete a task? 
A. Rotation of duties 
B. Separation of duties 
C. Dual controls 
D. Enforced mandatory vacations 
E. Workplace rules 
Answer: C 
Dual controls require that two entities work together to complete a task. This is used to reduce 
the possibility of fraud. 
QUESTION 1448: 
PGP provides which of the following?(Choose three) 
A. Confidentiality 
B. Accountability 
C. Accessibility 
D. Integrity 
E. Interest 
F. Non-repudiation 
G. Authenticity 
Answer: A,D,G 
PGP provides confidentiality, integrity, and authenticity. 
QUESTION 1449: 
Computer security is generally considered the responsibility of everyone in the 
organization.(True/False) 
A. True 
B. False 
Answer: A 
Everyone is responsible for security. 
QUESTION 1450: 
Which aspect of security was the Bell-LaPadula access control model designed to protect? 
A. Authenticity 
B. Accountability 
C. Accessibility 
D. Integrity 
E. Interest 
F. Non-repudiation 
G. Confidentiality 
Answer: G 
The Bell-LaPadula model is focused on maintaining confidentiality.
QUESTION 1451: 
Which access control method uses security policies and security awareness training to stop 
or deter an unauthorized activity from occurring? 
A. Administrative 
B. Preventative 
C. Detective 
D. Authoritative 
E. Corrective 
Answer: B 
Preventative access control is deployed to stop an unauthorized activity from occurring. 
QUESTION 1452: 
The Secure Hash Algorithm (SHA) is specified in? 
A. Digital Encryption Standard 
B. Digital Signature Standard 
C. Digital Encryption Standard 
D. Advanced Encryption Standard 
E. NSA 1403 
Answer: A 
The Secure Hash Algorithm (SHA) is specified in the Digital Encryption Standard. This is the 
most widely used encryption to date. It is used to encrypt millions of files ranging from matters 
of national security, to bank accounts, and electronic funds transfers. 
QUESTION 1453: 
Which of the following is an example of a symmetric key algorithm?(Choose all that apply) 
A. Rijndael 
B. RSA 
C. Diffie-Hellman 
D. Knapsack 
E. IDEA 
Answer: A,E 
All the others except Rijndael and IDEA are examples of asymmetric key algorithms. 
Actualtests.com - The Power of Knowing

Leave a Reply

Your email address will not be published. Required fields are marked *