2025年最新の有効なCISSPリアル試験問題（更新された）100%問題集と練習試験合格させます [Q483-Q507]

Explanation/Reference:
Explanation:
Because fiber-optic cable passes electrically non-conducting photons through a glass medium, it is resistant to Electromagnetic interference (EMI).
Incorrect Answers:
A: Microwaves are vulnerable to Electromagnetic interference (EMI).
C: Twisted pair cables are vulnerable to Electromagnetic interference (EMI).
D: Coaxial cables are vulnerable to Electromagnetic interference (EMI).

From the glossary of Computer Security Basics: The Bell-LaPadula model is the security policy model on which the Orange Book requirements are based. From the Orange Book definition, “A formal state transition model of computer security policy that describes a set of access control rules. In this formal model, the entities in a computer system are divided into abstract sets of subjects and objects. The notion of secure state is defined and it is proven that each state transition preserves security by moving from secure state to secure state; thus, inductively proving the system is secure. A system state is defined to be ‘secure’ if the only permitted access modes of subjects to objects are in accordance with a specific security policy. In order to determine whether or not a specific access mode is allowed, the clearance of a subject is compared to the classification of the object and a determination is made as to whether the subject is authorized for the specific access mode.” The Biba Model is an integrity model of computer security policy that describes a set of rules. In this model, a subject may not depend on any object or other subject that is less trusted than itself. The Clark Wilson Model is an integrity model for computer security policy designed for a commercial environment. It addresses such concepts as nondiscretionary access control, privilege separation, and least privilege. TEMPEST is a government program that prevents the compromising electrical and electromagnetic signals that emanate from computers and related equipment from being intercepted and deciphered. Source: RUSSEL, Deborah & GANGEMI, G.T. Sr., Computer Security Basics, O’Reilly, 1991. Also: U.S. Department of Defense, Trusted Computer System Evaluation Criteria (Orange Book), DOD 5200.28-STD. December 1985 (also available here).

Explanation/Reference:
Explanation:
Packet sniffing is the process of intercepting data as it is transmitted over a network.
A sniffer (packet sniffer) is a tool that intercepts data flowing in a network. If computers are connected to a local area network that is not filtered or switched, the traffic can be broadcast to all computers contained in the same segment. This doesn’t generally occur, since computers are generally told to ignore all the comings and goings of traffic from other computers. However, in the case of a sniffer, all traffic is shared when the sniffer software commands the Network Interface Card (NIC) to stop ignoring the traffic. The NIC is put into promiscuous mode, and it reads communications between computers within a particular segment. This allows the sniffer to seize everything that is flowing in the network, which can lead to the unauthorized access of sensitive data. A packet sniffer can take the form of either a hardware or software solution. A sniffer is also known as a packet analyzer.
Incorrect Answers:
B: Sniffers do not alter the source address of a computer to disguise and exploit weak authentication methods. This describes IP spoofing.
C: Sniffers do not take over network connections. Session Hijacking tools allow an attacker to take over network connections, kicking off the legitimate user or sharing a login.
D: Sniffers do not send IP fragments to a system that overlap with each other. This describes a Malformed Packet attack. Malformed Packet attacks are a type of DoS attack that involves one or two packets that are formatted in an unexpected way. Many vendor product implementations do not take into account all variations of user entries or packet types. If software handles such errors poorly, the system may crash when it receives such packets. A classic example of this type of attack involves sending IP fragments to a system that overlap with each other (the fragment offset values are incorrectly set. Some unpatched Windows and Linux systems will crash when the encounter such packets.
References:
http://www.techopedia.com/definition/4113/sniffer

The incident response plan focuses on information security responses to incidents affecting systems and/or networks. It establishes procedures to address cyber attacks against an organization’s IT systems. These procedures are designed to enable security personnel to identify, mitigate, and recover from malicious computer incidents, such as unauthorized access to a system or data, denial of service, or unauthorized changes to system hardware or software. The continuity of support plan is the same as an IT contingency plan. It addresses IT system disruptions and establishes procedures for recovering a major application or general support system. It is not business process focused. The business continuity plan addresses business processes and provides procedures for sustaining essential business operations while recovering from a significant disruption. The continuity of operations plan addresses the subset of an organization’s missions that are deemed most critical and procedures to sustain these functions at an alternate site for up to 30 days. Source: SWANSON, Marianne, & al., National Institute of Standards and Technology (NIST), NIST Special Publication 800-34, Contingency Planning Guide for Information Technology Systems, December 2001 (page 8).

An expert system shell provides the fundamental building blocks of
an expert system and supports the entering of domain knowledge.
Thus, for an application that is not complex and does not require the
custom development of the components of an expert system, an
expert system shell is a useful tool that will save development time.
*A knowledge base is a component of an expert system.
*. A neural network is another type of artificial
intelligence system that uses the neurons of the brain as a model and
solves problems using nonlinear pattern-matching techniques and
learning approaches.
*A knowledge acquisition system refers to the means of identifying and acquiring the knowledge to be entered into the knowledge base. In simple terms, it is trying to determine how an expert thinks when developing a solution to a problem.

The IAB considers the Internet a privilege, not a right, and as such considers it unethical to purposely disrupt communications.

Explanation/Reference:
Explanation:
RAID level 1 is mirroring of drives. Data are written to two drives at once. 50% of the disks are used for fault tolerance.
Incorrect Answers:
A: RAID level 0, data striping, provides no fault tolerance.
C: RAID Level 2 uses parity for fault tolerance, but is not used in production today.
D: RAID level 5 uses one parity bit for fault tolerance. With three drives, the minimum amount, 33% of the disks are for fault tolerance.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 1270

The key requirement for test results when implementing forensic procedures is that the test results must be reproducible. Forensic procedures are the methods and techniques that are used to collect, preserve, analyze, and present the digital evidence that is related to a security incident or a crime. Forensic procedures aim to establish the facts, the causes, the responsibilities, and the consequences of the incident or the crime, and to support the investigation and the prosecution of the perpetrators. The test results are the outcomes or the findings of the forensic procedures that are performed on the digital evidence, such as the identification, the extraction, the interpretation, or the verification of the data. The test results must be reproducible, which means that they must be consistent and verifiable, and that they can be repeated or replicated by other forensic examiners or analysts using the same methods and techniques. The reproducibility of the test results can enhance the credibility and the reliability of the forensic procedures, and ensure that the test results are valid and accurate. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 7: Security Operations, page 378. CISSP Practice Exam | Boson, Question 12.

Accountability is another facet of access control. Individuals on a system are responsible for their actions. This accountability property enables system activities to be traced to the proper individuals. Accountability is supported by audit trails that record events on the system and on the network. Audit trails can be used for intrusion detection and for the reconstruction of past events. -Ronald Krutz The CISSP PREP Guide (gold edition) pg 65

Explanation/Reference:
Explanation:
An incremental backup is fast because it copies only the files that have been modified since the previous backup.
Incorrect Answers:
A: A full backup is not fast as it copies all the data from the system to the backup medium.
C: There is no backup method called the fast backup method.
D: A differential backup is slower than an incremental backup since it copies more data. A differential backup copies only the difference in the data since the last full backup.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 1410

The correct answer is Integrity. The Clark-Wilson model is an integrity model.

Explanation/Reference:
Explanation:
Packet filtering was the first generation of firewalls and it is the most rudimentary type of all of the firewall technologies. Packet filtering gateways/firewalls would be insufficient for a medium-risk environment.
Incorrect Answers:
A: Packet filtering gateways can make access decisions based upon the following basic criteria:
Source and destination IP addresses

Source and destination port numbers

Protocol types

Inbound and outbound traffic direction

B: Packet filters are useful in IP address spoofing attack prevention because they are capable of filtering out and blocking packets with conflicting source address information (packets from outside the network that show source addresses from inside the network and vice-versa). On the other hand packet filtering gateways would not be able to protect against DNS spoofing. A stateful firewall is needed to protect against DNS spoofing
C: Packet filter gateways cannot ensure strong user authentication.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 630

This is not a benefit of a firewall. Most firewalls are limited when it comes to preventing the spread of viruses.
This question is testing your knowledge of Malware and Firewalls. The keywords within the questions are “usually” and “virus”. Once again to come up with the correct answer, you must stay within the context of the question and really ask yourself which of the 4 choices is NOT usually done by a firewall. Some of the latest Appliances such as Unified Threat Management (UTM) devices does have the ability to do virus scanning but most first and second generation firewalls would not have such ability. Remember, the questions is not asking about all possible scenarios that could exist but only about which of the 4 choices presented is the BEST.
For the exam you must know your general classes of Malware. There are generally four major classes of malicious code that fall under the general definition of malware:
1.Virus: Parasitic code that requires human action or insertion, or which attaches itself to another program to facilitate replication and distribution. Virus-infected containers can range from e-mail, documents, and data file macros to boot sectors, partitions, and memory fobs. Viruses were the first iteration of malware and were typically transferred by floppy disks (also known as “sneakernet”) and injected into memory when the disk was accessed or infected files were transferred from system to system.
2.Worm: Self-propagating code that exploits system or application vulnerabilities to replicate. Once on a system, it may execute embedded routines to alter, destroy, or monitor the system on which it is running, then move on to the next system. A worm is effectively a virus that does not require human interaction or other programs to infect systems.
3.Trojan Horse: Named after the Trojan horse of Greek mythology (and serving a very similar function), a Trojan horse is a general term referring to programs that appear desirable, but actually contain something harmful. A Trojan horse purports to do one thing that the user wants while secretly performing other potentially malicious actions. For example, a user may download a game file, install it, and begin playing the game. Unbeknownst to the user, the application may also install a virus, launch a worm, or install a utility allowing an attacker to gain unauthorized access to the system remotely, all without the user’s knowledge.
4.Spyware: Prior to its use in malicious activity, spyware was typically a hidden application injected through poor browser security by companies seeking to gain more information about a user’s Internet activity. Today, those methods are used to deploy other malware, collect private data, send advertising or commercial messages to a system, or monitor system input, such as keystrokes or mouse clicks.
The following answers are incorrect:
reduces the risks of external threats from malicious hackers. This is incorrect because a firewall
can reduce the risks of external threats from malicious hackers.
reduces the threat level on internal system. This is incorrect because a firewall can reduce the
threat level on internal system.
allows centralized management and control of services. This is incorrect because a firewall can
allow centralize management and control of services.
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition
((ISC)2 Press) (Kindle Locations 3989-4009). Auerbach Publications. Kindle Edition.

Answer “Complete loss of power” is a blackout, answer “Momentary high volta ” is a spike, and answer “Prolonged high voltage” is a surge.

“Identification is the act of a user professing an identity to a system, usually in the form of a logon ID to the system.” Pg 49 Krutz The CISSP Prep Guide.
“Identification describes a method of ensuring that a subject (user, program, or process) is the entity it claims to be. Identification can be provided with the use of a username or account number. To be properly authenticated, the subject is usually required to provide a second piece to the credential set. This piece could be a password, passphrase, cryptographic key, personal identification number (PIN), anatomical attribute, or token.” Pg 110 Shon Harris: All-in-One CISSP Certification

Explanation/Reference:
Explanation:
For a crime to be successfully prosecuted, solid evidence is required. Computer forensics is the art of retrieving this evidence and preserving it in the proper ways to make it admissible in court. Related system information must be captures and recorded.
Incorrect Answers:
A: To backup up a compromised system is a good idea, but it is not required for prosecution.
B: Identifying the attacks would be a useful further step, but first the evidence must be safeguarded.
D: To isolate a compromised system is a good idea, but it is not required for prosecution.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 1052

Debugging provides the basis for the programmer to correct the logic errors in a
program under development before it goes into production.
Source: Information Systems Audit and Control Association, Certified Information Systems Auditor
2002 review manual, chapter 6: Business Application System Development, Acquisition,
Implementation and Maintenance (page 298).

Business continuity planning (BCP) is primarily focused on ensuring that an organization can continue to operate and quickly recover its mission-critical processes in the event of a disruption.
This includes maintaining essential functions during and after a disaster and minimizing the impact on operations, employees, and customers. Restoring computer systems and other specific tasks are part of the broader goal of maintaining business continuity, but the primary objective is the timely recovery of crucial business processes.

The audit mechanism of a computer system has five important security goals:
1.The audit mechanism must allow the review of patterns of access to individual objects, access histories of specific processes and individuals, and the use of the various protection mechanisms supported by the system and their effectiveness.2
2.Allow discovery of both users and outsiders repeated attempts to bypass the protection mechanisms.
3.Allow discovery of any use of privileges that may occur when a user assumes a functionality with privileges greater than his
or her own, i.e., programmer to administrator. In this case, there may be no bypass of security controls, but nevertheless, a violation is made possible.
4.Act as a deterrent against perpetrators habitual attempts to bypass the system protection mechanisms. However, to act as a deterrent, the perpetrator must be aware of the audit mechanisms existence and its active use to detect any attempts to bypass system protection mechanisms.
5.Supply an additional form of user assurance that attempts to bypass the protection mechanisms that are recorded and discovered.3 Even if the attempt to bypass the protection mechanism is successful, the audit trail will still provide assurance by its ability to aid in assessing the damage done by the violation, thus improving the systems ability to control the damage.
Source: NCSC-TG-001 AGuide to Understanding Audit in Trusted Systems [Tan Book], and Gligor, Virgil D., Guidelines for Trusted Facility Management and Audit, University of Maryland, 1985.

Conducting a site physical security survey should enable the gathering of all information necessary to make an intelligent and informed risk assessment of the sites or facilities and create a physical security profile. From this point, additional controls can be developed and implemented to provide the most cost-effective security profile tailored to the specific needs of an enterprise.

The solution is as follows: OVERLORD becomes 14 21 4 17 11 14 17 3 BEGINS becomes 1 4 6 8 13 18 The key NEW becomes 13 4 22 Adding the key repetitively to OVERLORD BEGINS modulo 26 yields 1 5 0 4 15 10 4 7 23 17 10 4 0 22, which translates to BZAEPKEH XRKEAW
More in detail:

Explanation/Reference:
Explanation:
US-EU Safe Harbor process relates to privacy, that is protection of personal data. The Safe Harbor is a construct that outlines how U.S.-based companies can comply with the EU privacy. The Safe Harbor Privacy Principles states that if a non-European organization wants to do business with a European entity, it will need to adhere to the Safe Harbor requirements if certain types of data will be passed back and forth during business processes
Incorrect Answers:
A: The US-EU Safe Harbor process does not relate to the integrity of the data. It concerns the privacy of the data.
B: The US-EU Safe Harbor process does not relate to the Confidentiality of the data. It concerns the privacy of the data.
D: The US-EU Safe Harbor process does not relate to the Confidentiality of the data. It concerns the privacy of the data.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 992