[2023] Pass ISC CSSLP Test Practice Test Questions Exam Dumps
Verified CSSLP dumps Q&As - CSSLP dumps with Correct Answers
NEW QUESTION # 36
The IAM/CA makes certification accreditation recommendations to the DAA. The DAA issues accreditation determinations. Which of the following are the accreditation determinations issued by the DAA? Each correct answer represents a complete solution. Choose all that apply.
- A. ATT
- B. ATO
- C. DATO
- D. IATT
- E. IATO
Answer: B,C,D,E
Explanation:
Explanation/Reference:
Explanation: The DAA issues one of the following four accreditation determinations: Approval to Operate (ATO): It is an authorization of a DoD information system to process, store, or transmit information. Interim Approval to Operate (IATO): It is a temporary approval to operate based on an assessment of the implementation status of the assigned IA Controls. Interim Approval to Test (IATT): It is a temporary approval to conduct system testing based on an assessment of the implementation status of the assigned IA Controls. Denial of Approval to Operate (DATO): It is a determination that a DoD information system cannot operate because of an inadequate IA design or failure to implement assigned IA Controls. Answer:
E is incorrect. No such type of accreditation determination exists.
NEW QUESTION # 37
You work as a security manager for BlueWell Inc. You are going through the NIST SP 800-37 C&A methodology, which is based on four well defined phases. In which of the following phases of NIST SP
800-37 C&A methodology does the security categorization occur?
- A. Continuous Monitoring
- B. Security Certification
- C. Initiation
- D. Security Accreditation
Answer: C
Explanation:
Explanation/Reference:
Explanation: The various phases of NIST SP 800-37 C&A are as follows: Phase 1: Initiation- This phase includes preparation, notification and resource identification. It performs the security plan analysis, update, and acceptance. Phase 2: Security Certification- The Security certification phase evaluates the controls and documentation. Phase 3: Security Accreditation- The security accreditation phase examines the residual risk for acceptability, and prepares the final security accreditation package. Phase 4: Continuous Monitoring-This phase monitors the configuration management and control, ongoing security control verification, and status reporting and documentation.
NEW QUESTION # 38
Which of the following specifies access privileges to a collection of resources by using the URL mapping?
- A. Explanation:
Security constraint is a type of declarative security, which specifies the protection of web content. It also specifies access privileges to a collection of resources by using the URL mapping. A deployment descriptor is used to define the security constraint. Security constraint includes the following elements: Web resource collection Authorization constraint User data constraint - B. Security constraint
- C. Access Management
- D. Configuration Management
- E. Code Access Security
Answer: B
Explanation:
is incorrect. Code Access Security (CAS), in the Microsoft .NET framework, is Microsoft's solution to prevent untrusted code from performing privileged actions. When the CLR (common language runtime) loads an assembly it will obtain evidence for the assembly and use this to identify the code group that the assembly belongs to. A code group contains a permission set (one or more permissions). Code that performs a privileged action will perform a code access demand, which will cause the CLR to walk up the call stack and examine the permission set granted to the assembly of each method in the call stack. The code groups and permission sets are determined by the administrator of the machine who defines the security policy. Answer D is incorrect. Access Management is used to grant authorized users the right to use a service, while preventing access to non- authorized users. The Access Management process essentially executes policies defined in IT Security Management. It is sometimes also referred to as Rights Management or Identity Management. It is part of Service Operation and the owner of Access Management is the Access Manager. Access Management is added as a new process to ITIL V3. The sub-processes of Access Management are as follows: Maintain Catalogue of User Roles and Access Profiles Manage User Access Requests Answer C is incorrect. Configuration Management (CM) is an Information Technology Infrastructure Library (ITIL) IT Service Management (ITSM) process. It tracks all of the individual Configuration Items (CI) in an IT system, which may be as simple as a single server, or as complex as the entire IT department. In large organizations a configuration manager may be appointed to oversee and manage the CM process.
NEW QUESTION # 39
The Systems Development Life Cycle (SDLC) is the process of creating or altering the systems; and the models and methodologies that people use to develop these systems. Which of the following are the different phases of system development life cycle? Each correct answer represents a complete solution. Choose all that apply.
- A. Development/acquisition
- B. Operation/maintenance
- C. Testing
- D. Disposal
- E. Initiation
- F. Implementation
Answer: A,B,D,E,F
Explanation:
The Systems Development Life Cycle (SDLC), or Software Development Life Cycle in systems engineering, information systems, and software engineering, is the process of creating or altering the systems; and the models and methodologies that people use to develop these systems. The concept generally refers to computers or information systems. The following are the five phases in a generic System Development Life Cycle: 1.Initiation 2.Development/acquisition 3.Implementation 4.Operation/maintenance 5.Disposal
NEW QUESTION # 40
DRAG DROP
A number of security design patterns are developed for software assurance in general. Drag and drop the appropriate security design patterns in front of their respective descriptions.
Answer:
Explanation:
Explanation:
The various patterns applicable to software assurance in general are as follows: Hidden implementation: It limits the ability of an attacker to distinguish the internal workings of an application. Partitioned application: It splits a large and complex application into two or more simple components. Secure assertion: It distributes application-specific sanity checks throughout the system. Server sandbox: It creates a wall around the Web server to include the damage that occurs because of an undetected fault in the server or an exploited vulnerability.
NEW QUESTION # 41
DRAG DROP
Auditing is used to track user accounts for file and object access, logon attempts, system shutdown, and many more vulnerabilities to enhance the security of the network. It encompasses a wide variety of activities. Place the different auditing activities in front of their descriptions.
Answer:
Explanation:
Explanation:
Auditing encompasses a wide variety of activities as follows: Logging: It is the activity of recording information to a log file or database about events or occurrences. Log Analysis: It is a systematic form of monitoring where the logged information is analyzed in detail. It is done to find out the trends and patterns as well as abnormal, unauthorized, illegal, and policy-violating activities.
Intrusion Detection: It is a process to detect unwanted system access by monitoring both recorded information and real time events. Alarm Triggers: These are the notifications that are sent to an administrator whenever a specific event occurs. Monitoring: It is the activity of manually or programmatically reviewing logged information.
NEW QUESTION # 42
Which of the following statements best describes the difference between the role of a data owner and the role of a data custodian?
- A. The custodian implements the information classification scheme after the initial assignment by the operations manager.
- B. The data custodian implements the information classification scheme after the initial assignment by the data owner.
- C. The data owner implements the information classification scheme after the initial assignment by the custodian.
- D. The custodian makes the initial information classification assignments, and the operations manager implements the scheme.
Answer: B
Explanation:
The data owner is responsible for ensuring that the appropriate security controls are in place, for assigning the initial classification to the data to be protected, for approving access requests from other parts of the organization, and for periodically reviewing the data classifications and access rights. Data owners are primarily responsible for determining the data's sensitivity or classification levels, whereas the data custodian has the responsibility for backup, retention, and recovery of data. The data owner delegates these responsibilities to the custodian. Answer B, A, and C are incorrect. These are not the valid answers.
NEW QUESTION # 43
Which of the following phases of NIST SP 800-37 C&A methodology examines the residual risk for acceptability, and prepares the final security accreditation package?
- A. Continuous Monitoring
- B. Initiation
- C. Security Certification
- D. Security Accreditation
Answer: D
Explanation:
Explanation/Reference:
Explanation: The various phases of NIST SP 800-37 C&A are as follows: Phase 1: Initiation- This phase includes preparation, notification and resource identification. It performs the security plan analysis, update, and acceptance. Phase 2: Security Certification- The Security certification phase evaluates the controls and documentation. Phase 3: Security Accreditation- The security accreditation phase examines the residual risk for acceptability, and prepares the final security accreditation package. Phase 4: Continuous Monitoring-This phase monitors the configuration management and control, ongoing security control verification, and status reporting and documentation.
NEW QUESTION # 44
Fill in the blank with an appropriate phrase. A is defined as any activity that has an effect on defining, designing, building, or executing a task, requirement, or procedure.
- A. technical effort
Answer: A
Explanation:
A technical effort is described as any activity, which has an effect on defining, designing, building, or implementing a task, requirement, or procedure. The technical effort is an element of technical management that is required to progress efficiently and effectively from a business need to the deployment and operation of the system.
NEW QUESTION # 45
The Web resource collection is a security constraint element summarized in the Java Servlet Specification v2.4. Which of the following elements does it include? Each correct answer represents a complete solution. Choose two.
- A. Transport guarantees
- B. URL patterns
- C. HTTP methods
- D. Role names
Answer: B,C
Explanation:
Explanation/Reference:
Explanation: Web resource collection is a set of URL patterns and HTTP operations that define all resources required to be protected. It is a security constraint element summarized in the Java Servlet Specification v2.4. The Web resource collection includes the following elements: URL patterns HTTP methods AnswerB is incorrect. An authorization constraint includes role names. Answer: C is incorrect. A user data constraint includes transport guarantees.
NEW QUESTION # 46
Which of the following access control models uses a predefined set of access privileges for an object of a system?
- A. Policy Access Control
- B. Discretionary Access Control
- C. Role-Based Access Control
- D. Mandatory Access Control
Answer: D
Explanation:
Mandatory Access Control (MAC) is a model that uses a predefined set of access privileges for an object of the system. Access to an object is restricted on the basis of the sensitivity of the object and granted through authorization. Sensitivity of an object is defined by the label assigned to it. For example, if a user receives a copy of an object that is marked as "secret", he cannot grant permission to other users to see this object unless they have the appropriate permission. Answer B is incorrect. DAC is an access control model. In this model, the data owner has the right to decide who can access the data. Answer A is incorrect. Role-based access control (RBAC) is an access control model. In this model, a user can access resources according to his role in the organization. For example, a backup administrator is responsible for taking backups of important data. Therefore, he is only authorized to access this data for backing it up. However, sometimes users with different roles need to access the same resources. This situation can also be handled using the RBAC model. Answer C is incorrect. There is no such access control model as Policy Access Control.
NEW QUESTION # 47
Which of the following refers to a process that is used for implementing information security?
- A. Classic information security model
- B. Certification and Accreditation (C&A)
- C. Information Assurance (IA)
- D. Five Pillars model
Answer: B
Explanation:
Explanation/Reference:
Explanation: Certification and Accreditation (C&A or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing systems prior to or after a system is in operation. The C&A process is used extensively in the U.S. Federal Government.
Some C&A processes include FISMA, NIACAP, DIACAP, and DCID 6/3. Certification is a comprehensive assessment of the management, operational, and technical security controls in an information system, made in support of security accreditation, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system. Accreditation is the official management decision given by a senior agency official to authorize operation of an information system and to explicitly accept the risk to agency operations (including mission, functions, image, or reputation), agency assets, or individuals, based on the implementation of an agreed-upon set of security controls. AnswerD is incorrect. Information Assurance (IA) is the practice of managing risks related to the use, processing, storage, and transmission of information or data and the systems and processes used for those purposes. While focused dominantly on information in digital form, the full range of IA encompasses not only digital but also analog or physical form. Information assurance as a field has grown from the practice of information security, which in turn grew out of practices and procedures of computer security.
AnswerA is incorrect. The classic information security model is used in the practice of Information
Assurance (IA) to define assurance requirements. The classic information security model, also called the CIA Triad, addresses three attributes of information and information systems, confidentiality, integrity, and availability. This C-I-A model is extremely useful for teaching introductory and basic concepts of information security and assurance; the initials are an easy mnemonic to remember, and when properly understood, can prompt systems designers and users to address the most pressing aspects of assurance.
AnswerB is incorrect. The Five Pillars model is used in the practice of Information Assurance (IA) to
define assurance requirements. It was promulgated by the U.S. Department of Defense (DoD) in a variety of publications, beginning with the National Information Assurance Glossary, Committee on National Security Systems Instruction CNSSI-4009. Here is the definition from that publication: "Measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. These measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities." The Five Pillars model is sometimes criticized because authentication and non-repudiation are not attributes of information or systems; rather, they are procedures or methods useful to assure the integrity and authenticity of information, and to protect the confidentiality of the same.
NEW QUESTION # 48
Continuous Monitoring is the fourth phase of the security certification and accreditation process. What activities are performed in the Continuous Monitoring process? Each correct answer represents a complete solution. Choose all that apply.
- A. Security accreditation documentation
- B. Security accreditation decision
- C. Security control monitoring and impact analyses of changes to the information system
- D. Status reporting and documentation
- E. Configuration management and control
Answer: C,D,E
Explanation:
Continuous Monitoring is the fourth phase of the security certification and accreditation process. The Continuous Monitoring process consists of the following three main activities: Configuration management and control Security control monitoring and impact analyses of changes to the information system Status reporting and documentation The objective of these tasks is to observe and evaluate the information system security controls during the system life cycle. These tasks determine whether the changes that have occurred will negatively impact the system security. Answer A and C are incorrect. Security accreditation decision and security accreditation documentation are the two tasks of the security accreditation phase.
NEW QUESTION # 49
Which of the following components of configuration management involves periodic checks to determine the consistency and completeness of accounting information and to verify that all configuration management policies are being followed?
- A. Configuration Identification
- B. Configuration Auditing
- C. Configuration Status Accounting
- D. Configuration Control
Answer: B
Explanation:
Explanation/Reference:
Explanation: Configuration auditing is a component of configuration management, which involves periodic checks to establish the consistency and completeness of accounting information and to confirm that all configuration management policies are being followed. Configuration audits are broken into functional and physical configuration audits. They occur either at delivery or at the moment of effecting the change. A functional configuration audit ensures that functional and performance attributes of a configuration item are achieved, while a physical configuration audit ensures that a configuration item is installed in accordance with the requirements of its detailed design documentation. AnswerD is incorrect. The configuration status accounting procedure is the ability to record and report on the configuration baselines associated with each configuration item at any moment of time. It supports the functional and physical attributes of software at various points in time, and performs systematic control of accounting to the identified attributes for the purpose of maintaining software integrity and traceability throughout the software development life cycle. AnswerC is incorrect. Configuration control is a procedure of the Configuration management.
Configuration control is a set of processes and approval stages required to change a configuration item's attributes and to re-baseline them. It supports the change of the functional and physical attributes of software at various points in time, and performs systematic control of changes to the identified attributes.
AnswerA is incorrect. Configuration identification is the process of identifying the attributes that define
every aspect of a configuration item. A configuration item is a product (hardware and/or software) that has an end-user purpose. These attributes are recorded in configuration documentation and baselined.
Baselining an attribute forces formal configuration change control processes to be effected in the event that these attributes are changed.
NEW QUESTION # 50
Which of the following statements about the authentication concept of information security management is true?
- A. It ensures the reliable and timely access to resources.
- B. It determines the actions and behaviors of a single individual within a system, and identifies that particular individual.
- C. It establishes the users' identity and ensures that the users are who they say they are.
- D. It ensures that modifications are not made to data by unauthorized personnel or processes.
Answer: C
Explanation:
Explanation/Reference:
Explanation: The concept of authentication establishes the users' identity and ensures that the users are who they say they are. AnswerB is incorrect. The concept of availability ensures the reliable and timely access to data or resources. Answer: D is incorrect. The concept of integrity ensures that modifications are not made to data by unauthorized personnel or processes. Answer: C is incorrect. The concept of accountability determines the actions and behaviors of a single individual within a system, and identifies that particular individual.
NEW QUESTION # 51
FIPS 199 defines the three levels of potential impact on organizations: low, moderate, and high. Which of the following are the effects of loss of confidentiality, integrity, or availability in a high level potential impact?
- A. The loss of confidentiality, integrity, or availability might result in a major damage to organizational assets.
- B. The loss of confidentiality, integrity, or availability might result in major financial losses.
- C. The loss of confidentiality, integrity, or availability might result in severe damages like life threatening injuries or loss of life.
- D. The loss of confidentiality, integrity, or availability might cause severe degradation in or loss of mission capability to an extent.
Answer: A,B,C,D
Explanation:
The following are the effects of loss of confidentiality, integrity, or availability in a high level potential impact: It might cause a severe degradation in or loss of mission capability to an extent. It might result in a major damage to organizational assets. It might result in a major financial loss. It might result in severe harms such as serious life threatening injuries or loss of life.
NEW QUESTION # 52
......
Secure Software Lifecycle Management (11%):
- Decommission software;
- Promote software development’s security culture.
- Develop the security metrics, including defects-per-line-code, average remediation time, criticality level, and complexity;
- Execute continuous improvement;
- Secure version control and configuration, including documentation, software, hardware, patching, and interfaces;
- Explain and develop security documentation;
- Establish the standards and frameworks for security;
- Integrate IRM (Integrated Risk Management);
- Report security status, including feedback looks, dashboards, and reports;
- Maintain security in a software development methodology;
CSSLP certification guide Q&A from Training Expert Prep4pass: https://passguide.prep4pass.com/CSSLP_exam-braindumps.html
