(ISC)2 CISSP 問題練習

Question No : 1
Which Hyper Text Markup Language 5 (HTML5) option presents a security challenge for network data leakage prevention and/or monitoring?

• A.Cross Origin Resource Sharing (CORS)
• B.WebSockets
• C.Document Object Model (DOM) trees
• D.Web Interface Definition Language (IDL)

答えを確認する

正解:

Question No : 2
The three PRIMARY requirements for a penetration test are

• A.A defined goal, limited time period, and approval of management
• B.A general objective, unlimited time, and approval of the network administrator
• C.An objective statement, disclosed methodology, and fixed cost
• D.A stated objective, liability waiver, and disclosed methodology

答えを確認する

正解:

Question No : 3
The goal of software assurance in application development is to

• A.enable the development of High Availability (HA) systems.
• B.facilitate the creation of Trusted Computing Base (TCB) systems.
• C.prevent the creation of vulnerable applications.
• D.encourage the development of open source applications.

答えを確認する

正解:

Question No : 4
Which layer of the Open Systems Interconnections (OSI) model implementation adds information concerning the logical connection between the sender and receiver?

• A.Physical
• B.Session
• C.Transport
• D.Data-Link

答えを確認する

正解:

Question No : 5
What is the MOST important purpose of testing the Disaster Recovery Plan (DRP)?

• A.Evaluating the efficiency of the plan
• B.Identifying the benchmark required for restoration
• C.Validating the effectiveness of the plan
• D.Determining the Recovery Time Objective (RTO)

答えを確認する

正解:

Question No : 6
In the area of disaster planning and recovery, what strategy entails the presentation of information about the plan?

• A.Communication
• B.Planning
• C.Recovery
• D.Escalation

答えを確認する

正解:

Question No : 7
Checking routing information on e-mail to determine it is in a valid format and contains valid information is an example of which of the following anti-spam approaches?

• A.Simple Mail Transfer Protocol (SMTP) blacklist
• B.Reverse Domain Name System (DNS) lookup
• C.Hashing algorithm
• D.Header analysis

答えを確認する

正解:

Question No : 8
Logical access control programs are MOST effective when they are

• A.approved by external auditors.
• B.combined with security token technology.
• C.maintained by computer security officers.
• D.made part of the operating system.

答えを確認する

正解:

Question No : 9
Passive Infrared Sensors (PIR) used in a non-climate controlled environment should

• A.reduce the detected object temperature in relation to the background temperature.
• B.increase the detected object temperature in relation to the background temperature.
• C.automatically compensate for variance in background temperature.
• D.detect objects of a specific temperature independent of the background temperature.

答えを確認する

正解:

Question No : 10
A disadvantage of an application filtering firewall is that it can lead to

• A.a crash of the network as a result of user activities.
• B.performance degradation due to the rules applied.
• C.loss of packets on the network due to insufficient bandwidth.
• D.Internet Protocol (IP) spoofing by hackers.

答えを確認する

正解:

Question No : 11
Which one of the following security mechanisms provides the BEST way to restrict the execution of privileged procedures?

• A.Role Based Access Control (RBAC)
• B.Biometric access control
• C.Federated Identity Management (IdM)
• D.Application hardening

答えを確認する

正解:

Question No : 12
The birthday attack is MOST effective against which one of the following cipher technologies?

• A.Chaining block encryption
• B.Asymmetric cryptography
• C.Cryptographic hash
• D.Streaming cryptography

答えを確認する

正解:

Question No : 13
In a basic SYN flood attack, what is the attacker attempting to achieve?

• A.Exceed the threshold limit of the connection queue for a given service
• B.Set the threshold to zero for a given service
• C.Cause the buffer to overflow, allowing root access
• D.Flush the register stack, allowing hijacking of the root account

答えを確認する

正解:

Question No : 14
Which of the following methods protects Personally Identifiable Information (PII) by use of a full replacement of the data element?

• A.Transparent Database Encryption (TDE)
• B.Column level database encryption
• C.Volume encryption
• D.Data tokenization

答えを確認する

正解:

Question No : 15
An Intrusion Detection System (IDS) is generating alarms that a user account has over 100 failed login attempts per minute. A sniffer is placed on the network, and a variety of passwords for that user are noted .
Which of the following is MOST likely occurring?

• A.A dictionary attack
• B.A Denial of Service (DoS) attack
• C.A spoofing attack
• D.A backdoor installation

答えを確認する

正解: