Free Access to ISC.SSCP.v2022-07-27.q281 with Valid Practice Test (Page 54)

Question 261

Which of the following statements pertaining to software testing approaches is correct?

A.A bottom-up approach allows interface errors to be detected earlier.
B.A top-down approach allows errors in critical modules to be detected earlier.
C.The test plan and results should be retained as part of the system's permanent documentation.
D.Black box testing is predicated on a close examination of procedural detail.

Question 262

For maximum security design, what type of fence is most effective and cost-effective method (Foot are being used as measurement unit below)?

A.3' to 4' high
B.6' to 7' high
C.8' high and above with strands of barbed wire
D.Double fencing

Correct Answer: D

The most commonly used fence is the chain linked fence and it is the most
affordable. The standard is a six-foot high fence with two-inch mesh square openings. The
material should consist of nine-gauge vinyl or galvanized metal. Nine-gauge is a typical
fence material installed in residential areas.
Additionally, it is recommended to place barbed wire strands angled out from the top of the
fence at a 45 angle and away from the protected area with three strands running across
the top. This will provide for a seven-foot fence. There are several variations of the use of
"top guards" using V-shaped barbed wire or the use of concertina wire as an enhancement,
which has been a replacement for more traditional three strand barbed wire "top guards."
The fence should be fastened to ridged metal posts set in concrete every six feet with
additional bracing at the corners and gate openings. The bottom of the fence should be
stabilized against intruders crawling under by attaching posts along the bottom to keep the
fence from being pushed or pulled up from the bottom. If the soil is sandy, the bottom edge
of the fence should be installed below ground level.
For maximum security design, the use of double fencing with rolls of concertina wire
positioned between the two fences is the most effective deterrent and cost-efficient
method. In this design, an intruder is required to use an extensive array of ladders and
equipment to breach the fences.
Most fencing is largely a psychological deterrent and a boundary marker rather than a
barrier, because in most cases such fences can be rather easily penetrated unless added
security measures are taken to enhance the security of the fence. Sensors attached to the
fence to provide electronic monitoring of cutting or scaling the fence can be used.
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third
Edition ((ISC)2 Press) (Kindle Locations 24416-24431). Auerbach Publications. Kindle
Edition.

Question 263

What can be defined as: It confirms that users' needs have been met by the supplied solution ?

A.Accreditation
B.Certification
C.Assurance
D.Acceptance

Correct Answer: D

Explanation/Reference:
Acceptance confirms that users' needs have been met by the supplied solution. Verification and Validation informs Acceptance by establishing the evidence - set against acceptance criteria - to determine if the solution meets the users' needs. Acceptance should also explicitly address any integration or interoperability requirements involving other equipment or systems. To enable acceptance every user and system requirement must have a 'testable' characteristic.
Accreditation is the formal acceptance of security, adequacy, authorization for operation and acceptance of existing risk. Accreditation is the formal declaration by a Designated Approving Authority (DAA) that an IS is approved to operate in a particular security mode using a prescribed set of safeguards to an acceptable level of risk.
Certification is the formal testing of security safeguards and assurance is the degree of confidence that the implemented security measures work as intended. The certification is a Comprehensive evaluation of the technical and nontechnical security features of an IS and other safeguards, made in support of the accreditation process, to establish the extent to which a particular design and implementation meets a set of specified ecurity requirements.
Assurance is the descriptions of the measures taken during development and evaluation of the product to assure compliance with the claimed security functionality. For example, an evaluation may require that all source code is kept in a change management system, or that full functional testing is performed. The Common Criteria provides a catalogue of these, and the requirements may vary from one evaluation to the next. The requirements for particular targets or types of products are documented in the Security Targets (ST) and Protection Profiles (PP), respectively.
Source: ROTHKE, Ben, CISSP CBK Review presentation on domain 4, August 1999.
and
Official ISC2 Guide to the CISSP CBK, Second Edition, on page 211.
and
http://www.aof.mod.uk/aofcontent/tactical/randa/content/randaintroduction.htm

Question 264

Network-based Intrusion Detection systems:

A.Commonly reside on a discrete network segment and monitor the traffic on that network segment.
B.Commonly will not reside on a discrete network segment and monitor the traffic on that network segment.
C.Commonly reside on a discrete network segment and does not monitor the traffic on that network segment.
D.Commonly reside on a host and and monitor the traffic on that specific host.

Question 265

This is a common security issue that is extremely hard to control in large environments. It occurs when a user has more computer rights, permissions, and access than what is required for the tasks the user needs to fulfill.
What best describes this scenario?

A.Excessive Rights
B.Excessive Access
C.Excessive Permissions
D.Excessive Privileges

Question 261

Question 262

Question 263

Question 264

Question 265

Download PDF File