[Dec 11, 2023] Prepare For The CSSLP Question Papers In Advance [Q94-Q116]

QUESTION 94
Which of the following persons in an organization is responsible for rejecting or accepting the residual risk for a system?

Information Systems Security Officer (ISSO)

Designated Approving Authority (DAA)

System Owner

Chief Information Security Officer (CISO)

QUESTION 95
Which of the following are the basic characteristics of declarative security? Each correct answer represents a complete solution. Choose all that apply.

It is a container-managed security.

It has a runtime environment.

All security constraints are stated in the configuration files.

The security policies are applied at the deployment time.

QUESTION 96
John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He has successfully performed the following steps of the pre-attack phase to check the security of the We-are-secure network: Gathering information Determining the network range Identifying active systems Now, he wants to find the open ports and applications running on the network.
Which of the following tools will he use to accomplish his task?

ARIN

APNIC

RIPE

SuperScan

QUESTION 97
Rob is the project manager of the IDLK Project for his company. This project has a budget of $5,600,000 and is expected to last 18 months. Rob has learned that a new law may affect how the project is allowed to proceed – even though the organization has already invested over $750,000 in the project. What risk response is the most appropriate for this instance?

Transference

Enhance

Mitigation

Acceptance

QUESTION 98
Which of the following is a variant with regard to Configuration Management?

A CI that has the same name as another CI but shares no relationship.

A CI that particularly refers to a software version.

A CI that has the same essential functionality as another CI but a bit different in some small manner.

A CI that particularly refers to a hardware specification.

QUESTION 99
Which of the following provides an easy way to programmers for writing lower-risk applications and retrofitting security into an existing application?

Watermarking

Code obfuscation

Encryption wrapper

ESAPI

QUESTION 100
Which of the following configuration management system processes keeps track of the changes so that the latest acceptable configuration specifications are readily available?

Configuration Control

Configuration Status and Accounting

Configuration Verification and Audit

Configuration Identification

QUESTION 101
Which of the following techniques is used to identify attacks originating from a botnet?

Passive OS fingerprinting

Recipient filtering

IFilter

BPF-based filter

QUESTION 102
You are the project manager of the NNN project for your company. You and the project team are working together to plan the risk responses for the project. You feel that the team has successfully completed the risk response planning and now you must initiate what risk process it is. Which of the following risk processes is repeated after the plan risk responses to determine if the overall project risk has been satisfactorily decreased?

Quantitative risk analysis

Risk identification

Risk response implementation

Qualitative risk analysis

QUESTION 103
You work as a Network Auditor for Net Perfect Inc. The company has a Windows-based network. While auditing the company’s network, you are facing problems in searching the faults and other entities that belong to it. Which of the following risks may occur due to the existence of these problems?

Residual risk

Secondary risk

Detection risk

Inherent risk

QUESTION 104
Which of the following security controls will you use for the deployment phase of the SDLC to build secure software? Each correct answer represents a complete solution. Choose all that apply.

Change and Configuration Control

Security Certification and Accreditation (C&A)

Vulnerability Assessment and Penetration Testing

Risk Adjustments

QUESTION 105
Which of the following classification levels defines the information that, if disclosed to the unauthorized parties, could be reasonably expected to cause exceptionally grave damage to the national security?

Secret information

Unclassified information

Confidential information

Top Secret information

QUESTION 106
Which of the following is an attack with IP fragments that cannot be reassembled?

Password guessing attack

Teardrop attack

Dictionary attack

Smurf attack

QUESTION 107
Which of the following are examples of the application programming interface (API)? Each correct answer represents a complete solution. Choose three.

HTML

PHP

.NET

Perl

QUESTION 108
In which of the following phases of the DITSCAP process does Security Test and Evaluation (ST&E) occur?

Phase 2

Phase 4

Phase 3

Phase 1

QUESTION 109
Which of the following SDLC phases consists of the given security controls: Misuse Case Modeling Security Design and Architecture Review Threat and Risk Modeling Security Requirements and Test Cases Generation?

Deployment

Requirements Gathering

Maintenance

Design

QUESTION 110
Harry is the project manager of the MMQ Construction Project. In this project, Harry has identified a supplier who can create stained glass windows for 1,000 window units in the construction project. The supplier is an artist who works by himself, but creates windows for several companies throughout the United States. Management reviews the proposal to use this supplier and while they agree that the supplier is talented, they do not think the artist can fulfill the 1,000 window units in time for the project’s deadline. Management asked Harry to find a supplier who can fulfill the completion of the windows by the needed date in the schedule. What risk response has management asked Harry to implement?

Transference

Avoidance

Mitigation

Acceptance

Explanation/Reference:
Explanation: This is an example of mitigation. By changing to a more reliable supplier, Harry is reducing the probability the supplier will be late. It’s still possible that the vendor may not be able to deliver the stained glass windows, but the more reputable supplier reduces the probability of the lateness. Mitigation is a risk response planning technique associated with threats that seeks to reduce the probability of occurrence or impact of a risk to below an acceptable threshold. Risk mitigation involves taking early action to reduce the probability and impact of a risk occurring on the project. Adopting less complex processes, conducting more tests, or choosing a more stable supplier are examples of mitigation actions.
AnswerA is incorrect. Transference is when the risk is transferred to a third party, usually for a fee. While
this question does include a contractual relationship, the risk is the lateness of the windows. Transference focuses on transferring the risk to a third party to manage the risk event. In this instance, the management of the risk is owned by a third party; the third party actually creates the risk event because of the possibility of the lateness of the windows. AnswerB is incorrect. Avoidance changes the project plan to avoid the risk. If the project manager and management changed the window-type to a standard window in the project requirements, then this would be avoidance. Risk avoidance is a technique used for threats. It creates changes to the project management plan that are meant to either eliminate the risk completely or to protect the project objectives from its impact. Risk avoidance removes the risk event entirely either by adding additional steps to avoid the event or reducing the project scope requirements. It may seem the answer to all possible risks, but avoiding risks also means losing out on the potential gains that accepting (retaining) the risk might have allowed. AnswerD is incorrect. Acceptance accepts the risk that the windows could be late and offers no response.

QUESTION 111
Which of the following refers to the ability to ensure that the data is not modified or tampered with?

Integrity

Availability

Non-repudiation

Confidentiality

QUESTION 112
Which of the following phases of the DITSCAP C&A process is used to define the C&A level of effort, to identify the main C&A roles and responsibilities, and to create an agreement on the method for implementing the security requirements?

Phase 1

Phase 4

Phase 2

Phase 3

QUESTION 113
The DoD 8500 policy series represents the Department’s information assurance strategy. Which of the following objectives are defined by the DoD 8500 series? Each correct answer represents a complete solution. Choose all that apply.

Defending systems

Providing IA Certification and Accreditation

Providing command and control and situational awareness

Protecting information

QUESTION 114
Which of the following NIST documents provides a guideline for identifying an information system as a National Security System?

NIST SP 800-37

NIST SP 800-59

NIST SP 800-53

NIST SP 800-60

NIST SP 800-53A

QUESTION 115
Bill is the project manager of the JKH Project. He and the project team have identified a risk event in the project with a high probability of occurrence and the risk event has a high cost impact on the project. Bill discusses the risk event with Virginia, the primary project customer, and she decides that the requirements surrounding the risk event should be removed from the project. The removal of the requirements does affect the project scope, but it can release the project from the high risk exposure. What risk response has been enacted in this project?

Mitigation

Transference

Acceptance

Avoidance

QUESTION 116
Which of the following disaster recovery tests includes the operations that shut down at the primary site, and are shifted to the recovery site according to the disaster recovery plan?

Structured walk-through test

Full-interruption test

Parallel test

Simulation test