ISC Certified Information Systems Security Professional (CISSP) - CISSP무료 덤프문제 풀어보기

A. The RPO is the maximum amount of time for which loss of data is acceptable.

B. The RPO is a goal to recover a targeted percentage of data lost.

C. The RPO is the minimum amount of data that needs to be recovered.

D. The RPO is the amount of time it takes to recover an acceptable percentage of data lost.

A. Flaws in an application's intended workflow or rules that can be abused to achieve an unintended outcome, even though the application is functioning exactly as coded, without any traditional technical bug being present

B. Vulnerabilities caused exclusively by outdated encryption libraries

C. A vulnerability class that can always be detected by automated vulnerability scanners

D. Vulnerabilities that only affect the underlying database server

A. The risk associated exclusively with insider threats

B. The risk transferred to an insurance provider

C. The risk that remains after security controls have been implemented to mitigate the original risk

D. The total risk present before any controls are applied

A. Legal requirements determined by the organization headquarters' location

B. The value of the data to the organization's senior management

C. Organizational stakeholders, with classification approved by the management board

D. Legal requirements, value, criticality, and sensitivity to unauthorized disclosure or modification

A. Automated vulnerability scanning

B. Perform vulnerability scan by security team

C. Periodic third party vulnerability assessment

D. Review automated patch deployment reports

A. Gather physical evidence,

B. Establish order of volatility.

C. Assign responsibilities to personnel on the scene.

D. Establish a list of files to examine.

A. A baseline configuration is created and maintained for all relevant systems.

B. The firewall rules are backed up to an air-gapped system.

C. After installing a new system, the configuration files are copied to an air-gapped system and hashed to detect tampering.

D. After installing a new system, the configuration files are copied to a separate back-up system and hashed to detect tampering.

A. Implement change management

B. Implement path management

C. Implement port based security through 802.1x

D. Implement DHCP to assign IP address to server systems

A. Process isolation

B. Processor states

C. Address Space Layout Randomization (ASLR)

D. Access control mechanisms

A. Air-gap and harden the host used for management purposes

B. Isolate the full ICS by moving It onto its own network segment

C. Deploy a restrictive proxy between all clients and the vulnerable management station

D. Convince the management to decommission the ICS and mitigate to a modem technology

A. Quarterly or more frequently depending upon the advice of the information security manager

B. Semi-annually and in alignment with a fiscal half-year business cycle

C. Annually or less frequently depending upon audit department requirements

D. As often as necessary depending upon the stability of the environment and business requirements

A. Initiation

B. Development / Acquisition

C. Enumeration

D. Operation / Maintenance

A. Create a comparison database of cryptographic hashes of the files from a system with the same operating system and patch level.

B. Generate a message digest (MD) or secure hash on the drive image to detect tampering of the media being examined.

C. Discard harmless files for the operating system, and known installed programs.

D. Take another backup of the media in question then delete all irrelevant operating system files.

A. The formal management decision to authorize a system to operate

B. The formal, comprehensive evaluation of a system's technical and non-technical security features

C. The process of assigning a data classification level

D. The process of destroying media at end of life