최신ISC Certified Information Systems Security Professional (CISSP) - CISSP무료샘플문제

A. An attacker physically observes a user entering their credentials

B. An attacker uses lists of previously breached username/password pairs (obtained from other, unrelated breaches) to automatically attempt logins across many different websites, exploiting password reuse

C. An attacker exploits a SQL injection vulnerability to extract credentials from a database

D. An attacker attempts every possible character combination to guess a single password

A. A phishing attack that targets only financial institutions

B. A phishing attack conducted exclusively via SMS

C. A broad, untargeted phishing campaign sent to thousands of random recipients

D. A highly targeted phishing attack aimed specifically at senior executives or high-profile individuals within an organization

A. Alert data

B. User data

C. Content data

D. Statistical data

A. At planned intervals

B. When major changes occur on systems

C. Before and after Disaster Recovery (DR) tests

D. When personnel changes occur

A. Compliance office roles and responsibilities, classified material handling standards, storage system lifecycle requirements

B. Data stewardship roles, data handling and storage standards, data lifecycle requirements

C. System owner roles and responsibilities, data handling standards, storage and secure development lifecycle requirements

D. System authorization roles and responsibilities, cloud computing standards, lifecycle requirements

A. Use automated static analysis tools that target this type of weakness.

B. Use and specify a strong character encoding.

C. Perform input validation on any numeric inputs by assuring that they are within the expected range.

D. Use data flow analysis to minimize the number of false positives.

A. Notify system administrators.

B. Collect evidence.

C. Define the scope.

D. Identify team members.

A. A property ensuring that a compromise of a long-term private key does not compromise past session keys that were used to encrypt previous communications

B. A guarantee that encrypted data can never be decrypted, even by authorized parties

C. A method for generating passwords that never expire

D. A property exclusive to symmetric encryption algorithms

A. Role-based access control (RBAC)

B. Discretionary access control (DAC)

C. Mandatory access control (MAC)

D. Attribute-based access control (ABAC)

A. Perform incremental assessments.

B. Engage a third-party auditing firm.

C. Conduct penetration testing.

D. Review security architecture.

A. To demonstrate to the board of directors that senior management is committed to continuity recovery efforts

B. To demonstrate to the regulatory bodies that the company takes business continuity seriously

C. To provide each manager with precise direction on selecting an appropriate recovery alternative

D. To provide a formal declaration from senior management as required by internal audit to demonstrate sound business practices

A. System administrator

B. System owner

C. Data custodian

D. Data owner

A. Secure Shell (SSH)

B. Temporal Key Integrity Protocol (TKIP)

C. Secure Hash Algorithm (SHA)

D. Transport Layer Security (TLS)

A. Data Owner

B. Data Custodian

C. Data User

D. Data Reviewer