Practice Exam II

You will have 90 minutes to complete this exam, which consists of 60 questions. You will need to get at least 42 correct. Ensure you read each question and look for details that would rule out any of the answers. Many times there will be two or more correct answers; however, there is only one best answer that can be selected. This is a reflection of the real world, where the CISSP often has several options to secure his/her network but one best option. Such is the case when choosing the best encryption to secure data or wireless networks.

Leaving a question blank will count against you, so you are always better off taking your best guess. It’s best to work through the entire test once, answering the questions that you can easily answer. On the second pass, work on the more difficult questions. Others you have already answered could help you answer the remaining questions.

A. 4-foot

B. 6-foot

C. 8-foot

D. None of these is correct.

2. A fire caused by combustible metals would be considered which class of fire?

A. A

B. B

C. C

D. D

3. Controls should work in a layered approach. Review the following diagram; which order does the diagram most closely represent?

A. (1) Physical/preventative, (2) administrative/preventative, (3) technical/deterrent control layered approach

B. (1) Physical/preventative/deterrent, (2) technical/preventative/detective/, (3) administrative/preventative layered approach

C. (1)Deterrent/preventative, (2) administrative/detective (3) preventative training

D. (1) Physical/preventative/deterrent, (2) hardware/software preventative (3) administrative/preventative layered approach

4. Which of the following types of card keys contains rows of copper strips?

A. Magnetic strip

B. Electronic circuit

C. Magnetic stripe

D. Active electronic

5. Tony’s company manufactures proprietary tractor-trailer tracking devices. Now that employees will be issued laptops, Tony is concerned about the loss of confidential information if an employee’s laptop is stolen. Which of the following represents the best defensive method?

A. Use integrity programs such as MD5 and SHA to verify the validity of installed programs.

B. Place labels on the laptops offering a reward for stolen or missing units.

C. Issue laptop users locking cables to secure the units and prevent their theft.

D. Encrypt the hard drives.

6. Under what conditions can halon be expected to degrade into toxic compounds?

A. At temperatures greater than 500° F

B. At temperatures greater than 900° F and concentrations greater than 10%

C. At temperatures greater than 900° F

D. At temperatures greater than 500° F and concentrations greater than 7%

7. According to NIST perimeter lighting standards, critical areas should be illuminated to what measurement?

A. 10 feet in height, with 2 foot-candles of illuminance

B. 12 feet in height, with 4 foot-candles of illuminance

C. 8 feet in height, with 2 foot-candles of illuminance

D. 8 feet in height, with 4 foot-candles of illuminance

8. What type of biometric error signifies that an authorized user has been denied legitimate access?

A. Type I

B. Type II

C. Type III

D. Type IV

9. In biometrics, the point at which the FAR equals the FRR is known as which of the following?

A. Crossover error rate

B. Error acceptance rate

C. Crossover acceptance rate

D. Failure acceptance rate

10. RSA’s SecurID is an example of which of the following?

A. SSO system

B. Synchronous authentication

C. Token authentication

D. Asynchronous authentication

11. Which of the following is a weak implementation of EAP?

A. EAP-FAST

B. LEAP

C. PEAP

D. EAP-TLS

12. When discussing the security of SSO systems, which of the following is considered a disadvantage?

A. Single sign-on requires much more maintenance and overhead because all systems are tied together.

B. The biggest disadvantage to single sign-on is that system time on all systems must be held to very tight standards; if deviated from, this can cause serious access problems.

C. There are no real disadvantages to single sign-on.

D. If single sign-on is breached, it offers the intruder access to all systems tied to the SSO implementation.

13. Snort started as what type of system?

A. Behavior-based IPS system

B. Signature-based IDS system

C. Behavior-based IDS system

D. Signature-based IPS system

14. What type of attack is also known as a race condition?

A. Synchronous attack

B. Buffer overflow

C. Asynchronous attack

D. Scanlog attack

15. I/O drivers and utilities are typically found at what protected ring level?

A. Ring 1

B. Ring 2

C. Ring 3

D. Ring 0

16. What type of CPU can interleave two or more programs for execution at any one time?

A. Multiprogramming

B. Multitasking

C. Multiapp

D. Multiprocessor

17. This portion of the CPU performs arithmetic and logical operations on the binary data.

A. I/O buffer

B. Registers

C. Control circuit

D. ALU

18. You are a security consultant for a contracting agency; the agency chief wants to ensure he prevents subjects from writing information to a higher level than the subject’s security clearance. He also wants to ensure subjects from a higher level clearance cannot read information at a lower level. They require some type of access control models for their information systems to protect the integrity of their data. What is your best recommendation for a model to use?

A. Bell LaPadula

B. Biba

C. State Machine

D. Clark Wilson

19. What piece of documentation was developed to evaluate stand-alone systems and is a basis of measurement for confidentiality?

A. The Red Book

B. The Orange Book

C. Common Criteria

D. CTCPEC

20. Which level of Orange Book protection is considered mandatory protection and is the first level in which labels are required?

A. B3

B. C2

C. B1

D. A1

21. Which of the following is considered the totality of protection mechanisms within a computer system and is responsible for enforcing security?

A. Rings of protection

B. The security kernel

C. TCB

D. Resource isolation

22. Johnny is worried that someone might be able to intercept and decrypt his VoIP phone calls. Which of the following protocols is most closely associated with VoIP?

A. SKYP

B. SLIP

C. S/MIME

D. SIP

23. Which of the following wireless standards uses direct sequence spread spectrum (DSSS) by default?

A. Bluetooth

B. 802.11a

C. 802.11b

D. 802.11ac

24. What is a rogue AP?

A. An individual connected to an unauthorized modem

B. An unauthorized AP attached to the corporate network

C. An unauthorized modem attached to the network

D. An individual intercepting wireless traffic from inside or outside the organization

25. Pulse code modulation (PCM) is used to digitize a voice with 8 bits of sampling for transmission on a DS0 line. What is the maximum rate of encoding for one of these voice channels?

A. 28.8Kbps

B. 56Kbps

C. 64Kbps

D. 128Kbps

26. A T1 uses which of the following to multiplex DS0s into a composite T1?

A. Channel division

B. Frequency-hopping spread spectrum

C. Frequency division

D. Time division

27. Which of the following focuses on how to repair and restore the data center and information at an original or new primary site?

A. BCP

B. BCM

C. DRP

D. BIA

28. This type of service is used to provide protection for source code in case the manufacturer declares bankruptcy or goes broke.

A. Government access to keys

B. MAD

C. Electronic vaulting

D. Software escrow

29. Which of the following describes the cooperative effort between the United States and Europe to exchange information about European citizens between European firms and North American parent corporations?

A. SB 168

B. Demar Act

C. Safe Harbor

D. Safety Shield

30. Which of the following best describes an approved type of forensic duplication?

A. Logical copy

B. Bit copy

C. Microsoft backup

D. Xcopy

31. Which of the following best describes the SET protocol?

A. Originated by Victor Miller and Neal Koblitz for use as a digital signature cryptosystem. It is useful in applications for which memory, bandwidth, or computational power is limited.

B. Originated by MasterCard and Visa to be used on the Internet for credit card transactions. It uses digital signatures.

C. Originated by Victor Miller and Neal Koblitz for use as a key exchange cryptosystem. It is useful in applications for which memory, bandwidth, or computational power is limited.

D. Originated by MasterCard and Visa to be used on the Internet for credit card transactions. It uses the SSL protocol.

32. Which of the following information-management systems uses artificial intelligence?

A. Polyinstantiation

B. Known signature scanning

C. Application programming interface

D. Knowledge discovery in databases

33. DNS lookups that are less than 512 bytes are typically performed on which of the following protocols and ports?

A. UDP 53

B. UDP 69

C. TCP 53

D. UDP 161

34. Bob is worried that the program someone gave him at DEFCON has been altered from the original. Which of the following is a valid technique that Bob can use to verify its authenticity?

A. Run AES against the program.

B. Compare the size and date with the version found on the developer’s website.

C. Run an MD5sum and check against the MD5sum from developer sites.

D. Calculate a digital signature.

35. Which of the following is not an email encryption security standard?

A. IMAP

B. MOSS

C. PGP

D. PEM

36. Which of the following best describes link encryption?

A. Data is encrypted at the point of origin and is decrypted at the point of destination.

B. The message is decrypted and re-encrypted as it passes through each successive node using a key common to the two nodes.

C. The KDC shares a user-unique key with each user.

D. It requires a session key that the KDC shares between the originator and the final destination.

37. Diameter uses which of the following as a base?

A. TACACS

B. TACACS+

C. RADIUS

D. Kerberos

38. The ACID test is used to describe what?

A. Behavior-based intrusion detection

B. Database transactions

C. Signature-based intrusion detection

D. The strength of a cryptographic function

39. Which fault-tolerant-like system can back up media in much the same way as disk striping?

A. RAID

B. RAIT

C. JBOD

D. MAID

40. Which of the following is a stream cipher?

A. DES

B. Skipjack

C. RC4

D. Twofish

41. Which of the following is considered the weakest mode of DES?

A. Electronic Code Book

B. Cipher Block Chaining

C. Cipher Feedback

D. Output Feedback

42. Which ethical standard states that “access and use of the Internet is a privilege and should be treated as such by all users”?

A. RFC 1087

B. ISC² Code of Ethics

C. The Ten Commandments of Computer Ethics

D. RFC 1109

43. Which of the following would be considered the oldest and most well-known software development method?

A. Spiral

B. Clean room

C. Waterfall

D. Prototyping

44. Which of the following types of viruses can infect both boot sectors and program files?

A. File infector

B. Multipartite

C. Polymorphic

D. System infector

45. HTTPS uses TCP and which of the following ports?

A. 80

B. 110

C. 111

D. 443

46. Which of the following is considered the oldest type of database system?

A. Hierarchical

B. Network

C. Relational

D. Object-oriented

47. The IEEE separates the OSI data link layer into two sublayers. What are they?

A. Media MAC Control and Media Access Control

B. Logical Link Control and Media Access Control

C. High-Level Data Link Control and Media MAC Control

D. Data Link Control and Media MAC Control

Questions 48 and 49 refer to the table below

48. What does the model shown in the table represent?

A. MAC

B. RBAC

C. LBAC

D. Access Control Matrix

49. Using the model shown in the table, Mike, Christine, Dwayne and Betsy are _________ and Object 1, Object 2, and Object 3 are _____?

A. Objects and subjects

B. Subject and Objects

C. Names of users and resources the users access

D. Names of the users and objects the users access

50. 802.11 networks are identified by which of the following?

A. Security identifier (SID)

B. Broadcast name

C. Kismet

D. Service set identifier (SSID)

51. ISO 17799 evolved from what regional standard?

A. British standard 7799

B. Canadian Trusted Computer Product Evaluation Criteria (CTCPEC)

C. Information Technology Security Evaluation Criteria (ITSEC)

D. Trusted Computer System Evaluation Criteria (TCSEC)

52. A Common Criteria rating of “Functionally Tested” means the design meets what level of verification?

A. EAL 1

B. EAL 2

C. EAL 4

D. EAL 5

53. Which of the following is not addressed by the Clark-Wilson security model?

A. Blocks unauthorized individuals from making changes to data

B. Maintains internal and external consistency

C. Protects the confidentiality of the information

D. Blocks authorized individuals from making unauthorized changes to data

54. Which of the following individuals’ roles and responsibilities would include the responsibility for maintaining and protecting the company’s assets and data?

A. User

B. Data owner

C. Data custodian

D. Security auditor

55. Which of the following is the proper formula used to calculate ALE?

A. Single loss expectancy (SLE) × Annualized rate of occurrence (ARO)

B. Asset value × Annualized rate of occurrence (ARO)

C. Single loss expectancy (SLE) × Annualized rate of occurrence (ARO)

D. Asset value / Annualized rate of occurrence (ARO)

56. Which of the following best describes a qualitative assessment?

A. A qualitative assessment deals with real numbers and seeks to place dollar values on losses. These dollar amounts are then used to determine where to apply risk controls.

B. A qualitative assessment assigns ratings to each risk.

C. A qualitative assessment is performed by experts or external consultants who seek to place dollar values on losses.

D. A qualitative assessment is performed by experts or external consultants, is based on risk scenarios, and assigns non-dollar values to risks.

57. The facilitated risk assessment process is an example of what?

A. A BCP analysis technique

B. A quantitative assessment technique

C. A DRP analysis technique

D. A qualitative assessment technique

58. Classification levels like confidential and secret are tied to which data classification scheme?

A. ISO 17799

B. U.S. Department of Defense (DoD)

C. RFC 2196 Site Security Guidelines

D. Commercial Data Classification Standard (CDCS)

59. Which of the following methods of dealing with risk is considered the least prudent course of action?

A. Risk reduction

B. Risk rejection

C. Risk transference

D. Risk acceptance

60. Your employer is pleased that you have become CISSP-certified and would now like you to evaluate your company’s security policy. Your boss believes that encryption should be used for all network traffic and that a $50,000 encrypted database should replace the current customer database. Based on what you know about risk management, upon what should your decision to use encryption and purchase the new database be based? Choose the most correct answer.

A. If an analysis shows that there is potential risk, the cost of protecting the network and database should be weighed against the cost of the deterrent.

B. If an analysis shows that the company’s network is truly vulnerable, systems should be implemented to protect the network data and the customer database.

C. If the network is vulnerable, systems should be implemented to protect the network and the database, regardless of the price.

D. Because it is only a customer database and the company is not well known, the probability of attack is not as great; therefore, the risk should be accepted or transferred through the use of insurance.