CISSP-ISSEP Topic 1
QUESTION NO: 1
FITSAF stands for Federal Information Technology Security Assessment Framework. It is a methodology for assessing the security of information systems. Which of the following FITSAF levels shows that the procedures and controls are tested and reviewed.
A. Level 4
B. Level 5
C. Level 1
D. Level 2
E. Level 3
Answer: A
QUESTION NO: 2
Which of the following is a type of security management for computers and networks in order to identify security breaches
A. IPS
B. IDS
C. ASA
D. EAP
Answer: B
QUESTION NO: 3
Which of the following types of firewalls increases the security of data packets by remembering the state of connection at the network and the session layers as they pass through the filter
A. Stateless packet filter firewall
B. PIX firewall
C. Stateful packet filter firewall
D. Virtual firewall
Answer: C
QUESTION NO: 4
Which of the following federal laws is designed to protect computer data from theft
A. Federal Information Security Management Act (FISMA)
B. Computer Fraud and Abuse Act (CFAA)
C. Government Information Security Reform Act (GISRA)
D. Computer Security Act
Answer: B
QUESTION NO: 5
Which of the following is used to indicate that the software has met a defined quality level and is ready for mass distribution either by electronic means or by physical media
A. ATM
B. RTM
C. CRO
D. DAA
Answer: B
QUESTION NO: 6
Part of your change management plan details what should happen in the change control system for your project. Theresa, a junior project manager, asks what the configuration management activities are for scope changes. You tell her that all of the following are valid configuration management activities except for which one
A. Configuration Item Costing
B. Configuration Identification
C. Configuration Verification and Auditing
D. Configuration Status Accounting
Answer: A
QUESTION NO: 7
Which of the following professionals is responsible for starting the Certification & Accreditation
(C&A) process?
A. Authorizing Official
B. Information system owner
C. Chief Information Officer (CIO)
D. Chief Risk Officer (CRO)
Answer: B
QUESTION NO: 8
Which of the following security controls is a set of layered security services that address communications and data security problems in the emerging Internet and intranet application space?
A. Internet Protocol Security (IPSec)
B. Common data security architecture (CDSA)
C. File encryptors
D. Application program interface (API)
Answer: B
QUESTION NO: 9
Which of the following protocols is used to establish a secure terminal to a remote network device
A. WEP
B. SMTP
C. SSH
D. IPSec
Answer: C
QUESTION NO: 10
Which of the following elements of Registration task 4 defines the system’s external interfaces as well as the purpose of each external interface, and the relationship between the interface and the system
A. System firmware
B. System software
C. System interface
D. System hardware
Answer: C
QUESTION NO: 11
Which of the following guidelines is recommended for engineering, protecting, managing, processing, and controlling national security and sensitive (although unclassified) information
A. Federal Information Processing Standard (FIPS)
B. Special Publication (SP)
C. NISTIRs (Internal Reports)
D. DIACAP by the United States Department of Defense (DoD)
Answer: B
QUESTION NO: 12
Which of the following Security Control Assessment Tasks gathers the documentation and supporting materials essential for the assessment of the security controls in the information system
A. Security Control Assessment Task 4
B. Security Control Assessment Task 3
C. Security Control Assessment Task 1
D. Security Control Assessment Task 2
Answer: C
QUESTION NO: 13
Which of the following professionals plays the role of a monitor and takes part in the organization’s configuration management process
A. Chief Information Officer
B. Authorizing Official
C. Common Control Provider
D. Senior Agency Information Security Officer
Answer: C
QUESTION NO: 14
Which of the following processes culminates in an agreement between key players that a system in its current configuration and operation provides adequate protection controls
A. Certification and accreditation (C&A)
B. Risk Management
C. Information systems security engineering (ISSE)
D. Information Assurance (IA)
Answer: A
QUESTION NO: 15
The Phase 4 of DITSCAP C&A is known as Post Accreditation. This phase starts after the system has been accredited in Phase 3. What are the process activities of this phase Each correct answer represents a complete solution. Choose all that apply.
A. Security operations
B. Continue to review and refine the SSAA
C. Change management
D. Compliance validationE. System operations
F. Maintenance of the SSAA
Answer: A,C,D,E,F
QUESTION NO: 16
Which of the following email lists is written for the technical audiences, and provides weekly summaries of security issues, new vulnerabilities, potential impact, patches and workarounds, as well as the actions recommended to mitigate risk
A. Cyber Security Tip
B. Cyber Security Alert
C. Cyber Security Bulletin
D. Technical Cyber Security Alert
Answer: C
QUESTION NO: 17
Which of the following tasks obtains the customer agreement in planning the technical effort
A. Task 9
B. Task 11
C. Task 8
D. Task 10
Answer: B
QUESTION NO: 18 Which of the following documents were developed by NIST for conducting Certification & Accreditation (C&A) Each correct answer represents a complete solution. Choose all that apply.
A. NIST Special Publication 800-59
B. NIST Special Publication 800-60
C. NIST Special Publication 800-37A
D. NIST Special Publication 800-37
E. NIST Special Publication 800-53
F. NIST Special Publication 800-53A
Answer: A,B,D,E,F
QUESTION NO: 19
Which of the following elements are described by the functional requirements task Each correct answer represents a complete solution. Choose all that apply.
A. Coverage
B. Accuracy
C. Quality
D. Quantity
Answer: A,C,D
QUESTION NO: 20
Which of the following documents is defined as a source document, which is most useful for the
ISSE when classifying the needed security functionality
A. Information Protection Policy (IPP)
B. IMM
C. System Security Context
D. CONOPS
Answer: A
QUESTION NO: 21
DoD 8500.2 establishes IA controls for information systems according to the Mission Assurance Categories (MAC) and confidentiality levels. Which of the following MAC levels requires basic integrity and availability
A. MAC I
B. MAC II
C. MAC IV
MAC III
Answer: D
QUESTION NO: 22
What are the responsibilities of a system owner Each correct answer represents a complete solution. Choose all that apply.
A. Integrates security considerations into application and system purchasing decisions and development projects.
B. Ensures that the necessary security controls are in place.
C. Ensures that adequate security is being provided by the necessary controls, password management, remote access controls, operating system configurations, and so on.
D. Ensures that the systems are properly assessed for vulnerabilities and must report any to the incident response team and data owner.
Answer: A,C,D
QUESTION NO: 23
Which of the following Registration Tasks sets up the business or operational functional description and system identification
A. Registration Task 2
B. Registration Task 1
C. Registration Task 3
D. Registration Task 4
Answer: B
QUESTION NO: 24 CORRECT TEXT
SIMULATION
Fill in the blank with an appropriate section name. _________________ is a section of the SEMP template, which specifies the methods and reasoning planned to build the requisite trade-offs between functionality, performance, cost, and risk.
Answer:
System Analysis
QUESTION NO: 25
Which of the following federal agencies provides a forum for the discussion of policy issues, sets national policy, and promulgates direction, operational procedures, and guidance for the security of national security systems
A. National Security AgencyCentral Security Service (NSACSS)
B. National Institute of Standards and Technology (NIST)
C. United States Congress
D. Committee on National Security Systems (CNSS)
Answer: D
QUESTION NO: 26
Which of the following statements is true about residual risks
A. It can be considered as an indicator of threats coupled with vulnerability.
B. It is a weakness or lack of safeguard that can be exploited by a threat.
C. It is the probabilistic risk after implementing all security measures.
D. It is the probabilistic risk before implementing all security measures.
Answer: C
QUESTION NO: 27
According to U.S. Department of Defense (DoD) Instruction 8500.2, there are eight Information Assurance (IA) areas, and the controls are referred to as IA controls. Which of the following are among the eight areas of IA defined by DoD Each correct answer represents a complete solution. Choose all that apply.
A. DC Security Design & Configuration
B. EC Enclave and Computing Environment
C. VI Vulnerability and Incident Management
D. Information systems acquisition, development, and maintenance
Answer: A,B,C
QUESTION NO: 28
Certification and Accreditation (C&A or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing systems prior to or after a system is in operation. Which of the following statements are true about Certification and Accreditation Each correct answer represents a complete solution. Choose two.
A. Accreditation is a comprehensive assessment of the management, operational, and technical security controls in an information system.
B. Accreditation is the official management decision given by a senior agency official to authorize operation of an information system.
C. Certification is a comprehensive assessment of the management, operational, and technical security controls in an information system.
D. Certification is the official management decision given by a senior agency official to authorize operation of an information system.
Answer: B,C
QUESTION NO: 29
Which of the following protocols is built in the Web server and browser to encrypt data traveling over the Internet
A. UDP
B. SSL
C. IPSec
D. HTTP
Answer: B
QUESTION NO: 30
Which of the following configuration management system processes defines which items will be configuration managed, how they are to be identified, and how they are to be documented
A. Configuration verification and audit
B. Configuration control
C. Configuration status accounting
D. Configuration identification
Answer: D
QUESTION NO: 31
What are the subordinate tasks of the Initiate and Plan IA C&A phase of the DIACAP process
Each correct answer represents a complete solution. Choose all that apply.
A. Develop DIACAP strategy.
B. Initiate IA implementation plan.
C. Conduct validation activity.
D. Assemble DIACAP team.
E. Register system with DoD Component IA Program.
F. Assign IA controls.
Answer: A,B,D,E,F
QUESTION NO: 32
You work as a security engineer for BlueWell Inc. Which of the following documents will you use as a guide for the security certification and accreditation of Federal Information Systems
A. NIST Special Publication 800-59
B. NIST Special Publication 800-37
C. NIST Special Publication 800-60
D. NIST Special Publication 800-53
Answer: B
QUESTION NO: 33
Which of the following documents is described in the statement below It is developed along with all processes of the risk management. It contains the results of the qualitative risk analysis, quantitative risk analysis, and risk response planning.
A. Risk management plan
B. Project charter
C. Quality management plan
D. Risk register
Answer: D
QUESTION NO: 34
Diane is the project manager of the HGF Project. A risk that has been identified and analyzed in the project planning processes is now coming into fruition. What individual should respond to the risk with the pre planned risk response
A. Project sponsor
B. Risk owner
C. Diane
D. Subject matter expert
Answer: B
QUESTION NO: 35
Which of the following refers to a process that is used for implementing information security
A. Classic information security model
B. Certification and Accreditation (C&A)
C. Information Assurance (IA)
D. Five Pillars model
Answer: B
QUESTION NO: 36
In which of the following phases of the interconnection life cycle as defined by NIST SP 800-47, do the organizations build and execute a plan for establishing the interconnection, including executing or configuring appropriate security controls
A. Establishing the interconnection
B. Planning the interconnection
C. Disconnecting the interconnection
D. Maintaining the interconnection
Answer: A
QUESTION NO: 37
Which of the following tools demands involvement by upper executives, in order to integrate quality into the business system and avoid delegation of quality functions to junior administrators
A. ISO 90012000
B. Benchmarking
C. SEI-CMM
D. Six Sigma
Answer: A
QUESTION NO: 38
Which of the following documents contains the threats to the information management, and the security services and controls required to counter those threats
A. System Security Context
B. Information Protection Policy (IPP)
C. CONOPS
D. IMM
Answer: B
QUESTION NO: 39
Which of the following statements define the role of the ISSEP during the development of the detailed security design, as mentioned in the IATF document Each correct answer represents a complete solution. Choose all that apply.
A. It identifies the information protection problems that needs to be solved.
B. It allocates security mechanisms to system security design elements.
C. It identifies custom security products.
D. It identifies candidate commercial off-the-shelf (COTS)government off-the-shelf (GOTS) security products.
Answer: B,C,D
QUESTION NO: 40
Which of the following individuals is responsible for the oversight of a program that is supported by a team of people that consists of, or be exclusively comprised of contractors
A. Quality Assurance Manager
B. Senior Analyst
C. System Owner
D. Federal program manager
Answer: D
QUESTION NO: 41
Which of the following agencies serves the DoD community as the largest central resource for DoD and government-funded scientific, technical, engineering, and business related information available today
A. DISA
B. DIAP
C. DTIC
D. DARPA
Answer: C
QUESTION NO: 42
You work as a system engineer for BlueWell Inc. You want to verify that the build meets its data requirements, and correctly generates each expected display and report. Which of the following tests will help you to perform the above task
A. Functional test
B. Reliability test
C. Performance test
D. Regression test
Answer: A
QUESTION NO: 43
You work as a system engineer for BlueWell Inc. Which of the following documents will help you to describe the detailed plans, procedures, and schedules to guide the transition process
A. Configuration management plan
B. Transition plan
C. Systems engineering management plan (SEMP)
D. Acquisition plan
Answer: B
QUESTION NO: 44
Which of the following policies describes the national policy on the secure electronic messaging service?
A. NSTISSP No. 11
B. NSTISSP No. 7
C. NSTISSP No. 6
D. NSTISSP No. 101
Answer: B
QUESTION NO: 45
Which of the following is a subset discipline of Corporate Governance focused on information security systems and their performance and risk management
A. Computer Misuse Act
B. Clinger-Cohen Act
C. ISG
D. Lanham Act
Answer: C
