CISSP certification: Full 125 question practice test #1 – test 2 – Results

Spread the love

Question 7: Correct

What is happening when we experience buffer overflows?

The buffer overruns its boundaries and overwrites adjacent hard disk locations.
We are not using SSL/TLS.
The buffer overruns its boundaries and overwrites adjacent memory locations.

(Correct)
User session IDs or tokens are stolen.

Explanation

Buffer overflow (buffer overrun): An anomaly where a program, while writing data to a buffer, overruns the buffer’s boundary and overwrites adjacent memory locations, happen from improper coding when a programmer fails to perform bounds checking. Buffers are areas of memory set aside to hold data, often while moving it from one section of a program to another, or between programs. Buffer overflows can often be triggered by malformed inputs, if one assumes all inputs will be smaller than a certain size and the buffer is created to be that size, if an anomalous transaction produces more data it could cause it to write past the end of the buffer. If this overwrites adjacent data or executable code, this may result in erratic program behavior, including memory access errors, incorrect results, and crashes. By sending in data designed to cause a buffer overflow, it is possible to write into areas known to hold executable code, and replace it with malicious code.

Question 19: Correct

Why would an organization offer to use a source code escrow to their customers?

To make our source code publicly available.
So the customer has access to the source code if we go bankrupt.

(Correct)
To ensure the code is tested completely.
Because we want them to see the source code whenever they want to.

Explanation

Source code escrow: The deposit of the source code of software with a third party escrow agent. Escrow is typically requested by a party licensing software (the licensee), to ensure maintenance of the software instead of abandonment or orphaning. The software source code is released to the licensee if the licensor files for bankruptcy or otherwise fails to maintain and update the software as promised in the software license agreement.

Question 25: Skipped

As part of our risk management, we are working on quantitative risk analysis. Select all the terms we would use in this phase:

Annualized Loss Expectancy (ALE)

(Correct)
Risk Analysis Matrix (RAM)
Future Growth Potential (FGP)
Exposure factor (EF)

(Correct)
Asset Value (AV)

(Correct)

Explanation

Quantitative Risk Analysis – We want exactly enough security for our needs. This is where we put a number on that. We find the asset’s value: How much of it is compromised, how much one incident will cost, how often the incident occurs and how much that is per year. Asset Value (AV) – How much is the asset worth? Exposure factor (EF) – Percentage of Asset Value lost? Single Loss Expectancy (SLE) – (AV x EF) – What does it cost if it happens once? Annual Rate of Occurrence (ARO) – How often will this happen each year? Annualized Loss Expectancy (ALE) – This is what it cost per year if we do nothing.

Question 27: Correct

Jane is using the Scrum project management methodology. Which of these would be some of the core team roles in the Scrum framework? (Select all that apply).

The product owner.

(Correct)
The Scrum master.

(Correct)
The development team.

(Correct)
The project sponsor.
The project manager.

Explanation

Scrum is a framework for managing software development. Scrum is designed for teams of approximately 10 individuals, and generally relies on two-week development cycles, called “sprints”, as well as short daily stand-up meetings. The three core roles in the Scrum framework. The product owner: Representing the product’s stakeholders, the voice of the customer, and is accountable for ensuring that the team delivers value to the business. Development team: Responsible for delivering the product at the end of each sprint (sprint goal). The team is made up of 3–9 individuals who do the actual work (analysis, design, develop, test, technical communication, document, etc.). Scrum master: Facilitates and accountable for removing impediments to the ability of the team to deliver the product goals and deliverables. Not a traditional team lead or project manager but acts as a buffer between the team and any distracting influences. The scrum master ensures that the Scrum framework is followed.

Question 33: Skipped

When we talk about using cryptanalysis in our work, what are we doing?

A cryptographic algorithm.
Creates messages with a hidden meaning.
The science of securing communications.
The science of breaking encrypted communications.

(Correct)

Explanation

Cryptanalysis is the science of breaking encrypted communication. Cryptanalysis is used to breach cryptographic security systems and gain access to the contents of encrypted messages, even if the cryptographic key is unknown. It uses mathematical analysis of the cryptographic algorithm, as well as side-channel attacks that do not target weaknesses in the cryptographic algorithms themselves, but instead exploit weaknesses in their implementation and the devices that run them.

Question 40: Skipped

In software acceptance testing, what is the purpose of production acceptance testing?

To ensure the software perform as expected in our live environment vs. our development environment.

(Correct)
To ensure the backups are in place, we have a DR plan, how patching is handled and that the software is tested for vulnerabilities.
To ensure the software is as secure or more secure than the rules, laws and regulations of our industry.
To ensure the software is functional for and tested by the end user and the application manager.

Explanation

Compatibility/production testing: Does the software interface as expected with other applications or systems? Does the software perform as expected in our production environment vs. the development environment

Question 53: Skipped

What is a WEAKNESS of the Challenge Handshake Authentication Protocol (CHAP)?

Credentials are sent over the network in plaintext.
It periodically verifies the identity of clients with a 3-way handshake.
It uses incremental changing identifiers and variable challenge-values.
Credentials are stored in plaintext on the server.

(Correct)

Explanation

CHAP (Challenge-Handshake Authentication Protocol): The CHAP server stores plaintext passwords of each client, an attacker gaining access to the server can steal all the client passwords stored on it. Provides protection against replay attacks by the peer through the use of an incrementally changing identifier and of a variable challenge-value. Requires the client and server know the plaintext of a shared secret, but it is never sent over the network. Providing better security compared to PAP which is vulnerable for both these reasons. Used by PPP (Point to Point Protocol) servers to validate the remote clients. CHAP periodically verifies the identity of the client by using a three-way handshake.

Question 55: Correct

Which of these hackers would you hire to do penetration testing?

Gray hat hacker.
White hat hacker.

(Correct)
Black hat hacker.
Script kiddie.

Explanation

White Hat hackers: Professional Pen Testers trying to find flaws so we can fix it (Ethical Hackers). Black Hat hackers: Malicious hackers, trying to find flaws to exploit them (Crackers – they crack the code). Gray/Grey Hat hackers: They are somewhere between the white and black hats, they go looking for vulnerable code, systems or products. They often just publicize the vulnerability (which can lead to black hats using it before a patch is developed). Gray hats sometimes also approach the company with the vulnerability and ask them to fix it and if nothing happens they publish. Script Kiddies: They have little or no coding knowledge, but many sophisticated hacking tools are available and easy to use. They pose a very real threat. They are just as dangerous as skilled hackers; they often have no clue what they are doing.

Question 57: Incorrect

There are a lot of challenges with audit record management. Which of these is not of them?

Audit records are only reviewed for the bad stuff.

(Incorrect)
Logs are not reviews on a regular and timely basis.
We are storing logs and alerts for too long.

(Correct)
Log entries and alerts are not prioritized.

Explanation

Audit record management typically faces five distinct problems: Log are not reviewed on a regular and timely basis. Audit logs and audit trails are not stored for a long enough time period. Logs are not standardized or viewable by correlation toolsets – they are only viewable from the system being audited. Log entries and alerts are not prioritized. Audit records are only reviewed for the bad stuff.

Question 60: Incorrect

When we are categorizing disasters for our Business Continuity Plan (BCP), we would categorize them into which of these categories? (Select all that apply).

Environmental.

(Correct)
Natural.

(Correct)
Hardware.
Physical.
Human.

(Correct)

Explanation

We categorize disasters in 3 categories: natural, human, or environmental. Natural: Anything caused by nature; this could be earthquakes, floods, snow, tornados, etc. Human: Anything caused by humans; they can be intentional or unintentional disasters; unintentional could be an employee using a personal USB stick on a PC at work and spreading malware, which would be just as bad as if an attacker had done it, but the employee was just ignorant, careless, or didn’t think it would matter. Environmental (not to be confused with natural disasters); Anything in our environment; could be power outage/spikes, hardware failures, provider issues, etc.

Question 61: Skipped

In which order would you use the Software Development Life Cycle (SDLC)?

Analysis, investigation, design, build, implement, test, maintenance and support.
Investigation, design, analysis, build, implement, test, maintenance and support.
Investigation, analysis, design, build, test, implement, maintenance and support.

(Correct)
Investigation, analysis, design, build, implement, test, maintenance and support.

Explanation

SDLC (Software Development Life Cycle): The SDLC is not really a methodology, but a description of the phases in the life cycle of software development. These phases are (in general), investigation, analysis, design, build, test, implement, maintenance and support (and disposal). Can have security built into each step of the process, for the exam it always does.

Question 69: Skipped

We are implementing several new countermeasures to make our organization less susceptible to fraud. As part of that we are implementing mandatory vacations. How would we use those?

Used to upgrade systems.
A detective mechanism that can detect fraud.

(Correct)
Scheduled far in advance and the employee is notified.
Given to employees to reward them.

Explanation

Mandatory vacations: Done to ensure one person is not always performing the same task, someone else has to cover and it can keep fraud from happening or help us detect it. Their accounts are locked and an audit is performed on the accounts. If the employee has been conducting fraud and covering it up, the audit will discover it. The best way to do this is to not give too much advance notice of vacations.

Question 73: Skipped

We are throughout our organization using Intrusion detection systems (IDS) and Intrusion prevention system (IPS). What are some of the COMMON types of those?

Heuristic, host based, network based.

(Correct)
Switch based, network based, signature based.
Network based, host based, firewall based.
Signature based, network based, firewall based.

Explanation

IDSs (Intrusion Detection Systems) and IPSs (Intrusion Prevention Systems) can be categorized into 2 types and with 2 different approaches to identifying malicious traffic. Network based, placed on a network segment (a switch port in promiscuous mode). Host based, on a client, normally a server or workstation. Signature (Pattern) matching, similar to anti virus, it matches traffic against a long list of known malicious traffic patterns. Heuristic (Behavioral) based, uses a normal traffic pattern baseline to monitor for abnormal traffic.

Question 95: Skipped

Those acting under “the color of law” can act on an exigent circumstance. What would constitute exigent circumstances?

An outside circumstance which does not pose any threat to life or data.
An unpatched vulnerability on our systems, attackers have no way of exploiting.
Potential threat to data or human life in the future.
Immediate threat to human life or of evidence destruction.

(Correct)

Explanation

Exigent circumstances apply if there is an immediate threat to human life or of evidence destruction. This will later be decided by a court if it was justified. Only applies to law enforcement and those operating under the “color of law” – Title 18. U.S.C. Section 242 – Deprivation of Rights Under the Color of Law.

Question 96: Skipped

What could be one of the NEGATIVE consequences of implementing Single Sign On (SSO) in our organization?

SSO has weaker password requirements than regular applications does.
It is easier for users to just use one login.
It takes too long to remember a single password over many.
If compromised the attacker has access to all the systems the user does.

(Correct)

Explanation

SSO (Single sign-on): Users use a single sign-on for multiple systems. If an attacker compromises a single password they have access to everything that user can access. Often deployed in organizations where users have to access 10+ systems, and they think it is too burdensome to remember all those passwords. SSO have the same strong password requirements as normal single system passwords.

Question 101: Skipped

Why would we choose a centralized access control system over a decentralized one?

It is easier to manage.

(Correct)
Faster response time at remote locations.
If the internet between sites is down, we can’t authenticate.
Different security postures at different locations.

Explanation

Centralized Pros: (Decentralized Cons): All systems and locations have the same security posture. Easier to manage: All records, configurations and policies are centralized and only configured once per policy. Attackers look for the weakest link in our chain, if a small satellite office is not following our security posture, they can be an easy way onto our network. It is more secure, only a few people have access and can make changes to the system. It can also provide separation of duties, the local admin can’t edit/delete logs from their facility. SSO can be used for user access to multiple systems with one login. Centralized Con’s: (Decentralized Pros): Traffic overhead and response time, how long does it take for a door lock to authenticate the user against the database at the head office? Is connectivity to the head office stable, is important equipment on redundant power and internet?

Question 108: Skipped

After a security breach, Bob has been asked to ensure evidence integrity. What would he do with the compromised hard drive?

Encrypt the drive, then do his forensics on the original drive and when he is done do a hash.
Hash the drive and take a bit level copy, hash the copy drive and they should match, then work on the bit level copy.

(Correct)
Pull the drive from the system, format it and reinsert it into another production server.
Add another drive to the system and copy all he can see on the compromised drive onto the new drive and then do his analysis on the new drive.

Explanation

Evidence Integrity – It is vital that the evidence’s integrity cannot be questioned. We do this with hashes; any forensics is done on copies and never the originals. We make a bit level copy of the original, hash it, and the copy should match. We do another hash after the forensics, and that should be the same as the prior two.

Question 110: Skipped

After a major security breach, we are wanting to a lessons learned. Why is that?

To show what exactly happened in this incident.
To blame someone.
To prevent incidents from ever happening again.
To learn from the incident so we can do better on future incidents.

(Correct)

Explanation

Lessons Learned: This phase is often overlooked, we removed the problem, we have implemented new controls and safeguards. We can learn a lot from lessons learned, not just about the specific incidence, but how well we handle them, what worked, what didn’t. How can we as an organization grow and become better next time we have another incidence, while we may have fixed this one vulnerability there are potentially 100’s of new ones we know nothing about yet. At the end of lessons learned we produce a report to senior management, with our finding, we can only make suggestions, they are ultimately in charge (and liable).