CISSP exam

Which of the following factors contributes to the weakness of Wired Equivalent Privacy (WEP) protocol?A . WEP uses a small range Initialization Vector (IV)B . WEP uses Message Digest 5 (MD5)C . WEP uses Diffie-HellmanD . WEP does not use any Initialization Vector (IV)View AnswerAnswer: A Explanation: Reference: http://www.dummies.com/programming/networking/understanding-wep-weaknesses/

Which of the following operates at the Network Layer of the Open System Interconnection (OSI) model?A . Packet filteringB . Port services filteringC . Content filteringD . Application access controlView AnswerAnswer: A Explanation: Reference: https://www.sans.org/reading-room/whitepapers/protocols/applying-osi-layer-network-model­information-security-1309 (10)

An organization has doubled in size due to a rapid market share increase. The size of the Information Technology (IT) staff has maintained pace with this growth. The organization hires several contractors whose onsite time is limited. The IT department has pushed its limits building servers and rolling out workstations...

Which of the following management process allows ONLY those services required for users to accomplish their tasks, change default user passwords, and set servers to retrieve antivirus updates?A . ConfigurationB . IdentityC . ComplianceD . PatchView AnswerAnswer: A

Which technique can be used to make an encryption scheme more resistant to a known plaintext attack?A . Hashing the data before encryptionB . Hashing the data after encryptionC . Compressing the data after encryptionD . Compressing the data before encryptionView AnswerAnswer: A

When implementing a data classification program, why is it important to avoid too much granularity?A . The process will require too many resourcesB . It will be difficult to apply to both hardware and softwareC . It will be difficult to assign ownership to the dataD . The process will...

Which of the following is a common characteristic of privacy?A . Provision for maintaining an audit trail of access to the private dataB . Notice to the subject of the existence of a database containing relevant credit card dataC . Process for the subject to inspect and correct personal data...

Which of the following mandates the amount and complexity of security controls applied to a security risk?A . Security vulnerabilitiesB . Risk toleranceC . Risk mitigationD . Security staffView AnswerAnswer: C

What does a Synchronous (SYN) flood attack do?A . Forces Transmission Control Protocol /Internet Protocol (TCP/IP) connections into a reset stateB . Establishes many new Transmission Control Protocol /Internet Protocol (TCP/IP) connectionsC . Empties the queue of pending Transmission Control Protocol /Internet Protocol (TCP/IP) requestsD . Exceeds the limits for...

When developing a business case for updating a security program, the security program owner MUST do which of the following?A . Identify relevant metricsB . Prepare performance test reportsC . Obtain resources for the security programD . Interview executive managementView AnswerAnswer: A