Get Latest Mar-2026 Conduct effective penetration tests using ActualPDF CISSP exam [Q236-Q254]

Get Latest [Mar-2026] Conduct effective penetration tests using ActualPDF CISSP

Penetration testers simulate CISSP exam PDF

The CISSP exam covers a wide range of topics, including security and risk management, asset security, security engineering, communications and network security, identity and access management, security assessment and testing, security operations, and software development security. CISSP exam consists of 250 multiple-choice questions, and test-takers have six hours to complete the exam. To become certified, candidates must pass the exam and have at least five years of experience in the field of information security, or four years of experience and a college degree.

Levels of CISSP Certification:

There are four levels of CISSP certification. These levels are Professional Certified Security Analyst, Associate Certified Security Analyst, Certified Information Systems Security Professional (CISSP), and the highest level Master Certified Information Systems Security Professional (MCISSP). The professional level requires passing six exams to achieve, while associate requires six exams to achieve. The Associate-level exam is an objective test that candidates can take online or skype, while professional exam candidates only have access to one option. The CISSP exam tests for knowledge of concepts such as network security, software security, cryptography, physical security, and general security principles. CISSP Dumps will help in prep by providing practice exams. Candidates must pass a rigorous 8-hour long exam and demonstrate proficiency in at least 10 out of 12 knowledge areas.

Candidates take the test at their own expense and will be unable to view their results until the end of the testing period. In order to be considered for a certification or renewal, at least two years must have lapsed since the previous exam date. CISSP certification holders must recertify every three years through continuing education in order to maintain certification. To receive continuing education credit, candidates must maintain a current membership within one of the following organizations: AICPA, CISSP CertVerify, ISACA, ISSA, ISC2 Security Forum, ISSA-Minnesota Chapter/IT Audit & Control Association (ITACA), NACHA-The Electronic Payments Association.

To recertify at the Professional level of certification one must earn 60 CEUs. To recertify at the Associate level of certification one must earn 40 CEUs. Candidates are able to earn up to four continuing education units for each exam. Candidates can earn up to 16 continuing education units through their participation in the IT Security Resources Community of Interest (CIOI).

NO.236 Which of the following services is provided by S-RPC?

 Availability

 Accountability

 Integrity

 Authentication

Secure RPC provides authentication services. Secure RPC (Remote Procedure
Call) protects remote procedures with an authentication mechanism. The Diffie-Hellman
authentication mechanism authenticates both the host and the user who is making a request for a
service. The authentication mechanism uses Data Encryption Standard (DES) encryption.
Applications that use Secure RPC include NFS and the naming services, NIS and NIS+.
WHAT IS RPC?
Remote Procedure Call (RPC) is a protocol that one program can use to request a service from a
program located in another computer in a network without having to understand network details.
(A procedure call is also sometimes known as a function call or a subroutine call.) RPC uses the
client/server model. The requesting program is a client and the service-providing program is the server. Like a regular or local procedure call, an RPC is a synchronous operation requiring the requesting program to be suspended until the results of the remote procedure are returned. However, the use of lightweight processes or threads that share the same address space allows multiple RPCs to be performed concurrently. When program statements that use RPC are compiled into an executable program, a stub is included in the compiled code that acts as the representative of the remote procedure code. When the program is run and the procedure call is issued, the stub receives the request and forwards it to a client runtime program in the local computer. The client runtime program has the knowledge of how to address the remote computer and server application and sends the message across the network that requests the remote procedure. Similarly, the server includes a runtime program and stub that interface with the remote procedure itself. Results are returned the same way. There are several RPC models and implementations. A popular model and implementation is the Open Software Foundation’s Distributed Computing Environment (DCE). The Institute of Electrical and Electronics Engineers defines RPC in its ISO Remote Procedure Call Specification, ISO/IEC CD 11578 N6561, ISO/IEC, November 1991. RPC spans the Transport layer and the Application layer in the Open Systems Interconnection (OSI) model of network communication. RPC makes it easier to develop an application that includes multiple programs distributed in a network. All of the other answers are not features of S/RPC.
Reference(s) used for this Question: http://docs.sun.com/app/docs/doc/816-4883/6mb2joane?a=view and http://docs.oracle.com/cd/E23823_01/html/816-4557/auth-2.html and

NO.237 Which one of the following access control models associates every resource and every user of a resource with one of an ordered set of classes?

 Take-Grant model

 Biba model

 Lattice model

 Clark-Wilson model

With a lattice model you first have to define a set of security classes that can be assigned to users or objects…After you have defined set of security classes, you define a set flow operations showing when information can flow from one class to another – Roberta Bragg Cissp Certification Training Guide (que) pg 23

NO.238 A large manufacturing organization arranges to buy an industrial machine system to produce a new line of products. The system includes software provided to the vendor by a thirdparty organization. The financial risk to the manufacturing organization starting production is high. What step should the manufacturing organization take to minimize its financial risk in the new venture prior to the purchase?

 Hire a performance tester to execute offline tests on a system.

 Calculate the possible loss in revenue to the organization due to software bugs and vulnerabilities, and compare that to the system’s overall price.

 Place the machine behind a Layer 3 firewall.

 Require that the software be thoroughly tested by an accredited independent software testing company.

NO.239 Which of the following types of data center is MOST suitable for cloud services?

 Enterprise

 Software defined

 On-premise

 Wholesale

NO.240 A token that generates a unique password at fixed time intervals is called:

 A synchronous dynamic password token.

 A challenge-response token.

 A time-sensitive token.

 An asynchronous dynamic password token.

The correct answer is “A synchronous dynamic password token”.

NO.241 Which of the following is NOT a property of CSMA?

 The workstation continuously monitors the line.

 Workstations are not permitted to transmit until they are given permission from the primary host.

 It does not have a feature to avoid the problem of one workstation dominating the conversation.

 The workstation transmits the data packet when it thinks that the line is free.

The correct answer is “Workstations are not permitted to transmit until they are given permission from the primary host”. The polling transmission type uses primary and secondary hosts, and the secondary must wait for permission from the primary before transmitting.

NO.242 Primary run when time and tape space permits, and is used for the system archive or baselined tape sets is the?

 Full backup method.

 Incremental backup method.

 Differential backup method.

 Tape backup method.

“Full” backup method provides a baseline for our systems for Restore; the full backup must be done at least once regardless of the method you are using to make backups. It’s very common to use full backups in combination with incremental or differential ones to decrease the backup time (however you increment the restore time with incremental and differential) because it takes the largest time to complete. You always need to begin a system restoration from your baseline, and this baseline is the Full Backup.

NO.243 Which of the following characteristics pertaining to databases is not true?

 A data model should exist and all entities should have a significant name.

 Justifications must exist for normalized data.

 No NULLs should be allowed for primary keys.

 All relations must have a specific cardinality.

Justifications should be provided when data is denormalized, not when it is normalized, because it introduces risk of data inconsistency. Denormalization is usually introduced for performance purposes. Source: Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, Chapter 3: Technical Infrastructure and Operational Practices (page 108).

NO.244 What level of Redundant Array of Independent Disks (RAID) is configured PRIMARILY for high-performance data reads and writes?

 RAID-0

 RAID-1

 RAID-5

 RAID-6

NO.245 Which trusted facility management concept implies that two operators must review and approve the work of each other?

 Two-man control

 Dual control

 Double control

 Segregation control

“In the concept of two-man control, two operators review and approve the work of each other. The purpose of two-man control is to provide accountability and to minimize fraud in highly sensitive or high-risk transactions. The concept of dual control means that both operators are needed to complete a sensitive task.” Pg. 303 Krutz: The CISSP Prep Guide: Gold Edition.

NO.246 Which of the following is applicable to a publicly held company concerned about information handling and storage requirement specific to the financial reporting?

 Privacy Act of 1974

 Clinger-Cohan Act of 1996

 Sarbanes-Oxley (SOX) Act of 2002

 International Organization for Standardization (ISO) 27001

The Sarbanes-Oxley (SOX) Act of 2002 is applicable to a publicly held company concerned about information handling and storage requirements specific to the financial reporting. SOX is a federal law that aims to protect investors from fraudulent accounting activities by corporations. SOX requires public companies to establish and maintain internal controls over their financial reporting processes, and to have their financial statements audited by an independent auditor. SOX also mandates that public companies retain their financial records and related audit documents for at least five years, and that they implement proper security measures to protect the confidentiality, integrity, and availability of their financial information. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 1: Security and Risk Management, page 19. CISSP Practice Exam | Boson, Question 8.

NO.247 The PRIMARY purpose of accreditation is to:

 comply with applicable laws and regulations.

 allow senior management to make an informed decision regarding whether to accept the risk of operating the system.

 protect an organization’s sensitive datA.

 verify that all security controls have been implemented properly and are operating in the correct manner.

According to the CISSP CBK Official Study Guide1, the primary purpose of accreditation is to allow senior management to make an informed decision regarding whether to accept the risk of operating the system.
Accreditation is the process of formally authorizing a system to operate based on the results of the security assessment and the risk analysis. Accreditation is a management responsibility that involves evaluating the security posture, the residual risk, and the compliance status of the system, and determining if the system is acceptable to operate within the organization’s risk tolerance. Accreditation does not necessarily mean that the system complies with applicable laws and regulations, protects the organization’s sensitive data, or verifies that all security controls have been implemented properly and are operating in the correct manner, although these may be factors that influence the accreditation decision. References: 1

NO.248 Functional security testing is MOST critical during which phese of the system development Life Cycle (SDLC)?

 Acquisition / Development

 Operations / Maintenance

 Implementation

 Initiation

NO.249 Which of the following describes a computer processing architecture in which a language compiler or pre- processor breaks program instructions down into basic operations that can be performed by the processor at the same time?

 Very-Long Instruction-Word Processor (VLIW)

 Complex-Instruction-Set-Computer (CISC)

 Reduced-Instruction-Set-Computer (RISC)

 Super Scalar Processor Architecture (SCPA)

Explanation/Reference:
Explanation:
Very long instruction word (VLIW) describes a computer processing architecture in which a language compiler or pre-processor breaks program instruction down into basic operations that can be performed by the processor in parallel (that is, at the same time).
These operations are put into a very long instruction word which the processor can then take apart without further analysis, handing each operation to an appropriate functional unit. The following answer are incorrect: The term “CISC” (complex instruction set computer or computing) refers to computers designed with a full set of computer instructions that were intended to provide needed capabilities in the most efficient way.
Later, it was discovered that, by reducing the full set to only the most frequently used instructions, the computer would get more work done in a shorter amount of time for most applications. Intel’s Pentium microprocessors are CISC microprocessors. The PowerPC microprocessor, used in IBM’s RISC System/6000 workstation and Macintosh computers, is a RISC microprocessor. RISC takes each of the longer, more complex instructions from a CISC design and reduces it to multiple instructions that are shorter and faster to process.
RISC technology has been a staple of mobile devices for decades, but it is now finally poised to take on a serious role in data center servers and server virtualization. The latest RISC processors support virtualization and will change the way computing resources scale to meet workload demands. A superscalar CPU architecture implements a form of parallelism called instruction level parallelism within a single processor. It therefore allows faster CPU throughput than would otherwise be possible at a given clock rate. A superscalar processor executes more than one instruction during a clock cycle by simultaneously dispatching multiple instructions to redundant functional units on the processor. Each functional unit is not a separate CPU core but an execution resource within a single CPU such as an arithmetic logic unit, a bit shifter, or a multiplier.
References:
http://whatis.techtarget.com/definition/0,,sid9_gci214395,00.html
http://searchcio-midmarket.techtarget.com/definition/CISC
http://en.wikipedia.org/wiki/Superscalar

NO.250 Which media control below is the BEST choice to prevent data
remanence on magnetic tapes or floppy disks?

 Applying a concentration of hydriodic acid (55% to 58% solution) to the gamma ferric oxide disk surface

 Overwriting the media with new application data

 Degaussing the media

 Making sure the disk is re-circulated as quickly as possible to prevent object reuse

Degaussing is recommended as the best method for purging most magnetic mediA. Degaussing is a process whereby the magnetic media is erased, i.e., returned to its initial virgin statE. Erasure via degaussing may be accomplished in two ways: In AC erasure, the media is degaussed by applying an alternating field that is reduced in amplitude over time from an initial high value (i.e., AC-powered) In DC erasure, the media is saturated by applying a unidirectional field (i.e., DC-powered or by employing a permanent magnet) Another point about degaussing: Degaussed magnetic hard drives will generally require restoration of factory-installed timing tracks, so data purging is recommendeD. Also, physical destruction of CDROM or WORM media is required. *Answer ” Overwriting the media with new application data” is not recommended because the application may not completely overwrite the old data properly, and strict configuration controls must be in place on both the operating system and the software itselF. Also, bad sectors on the media may not permit the software to overwrite old data properly. To satisfy the DoD clearing requirement, it is sufficient to write any character to all data locations in question (purging). To purge the media, the DoD requires overwriting with a pattern, then its complement, and finally with another pattern; e.g., overwrite first with 0011 0101, followed by 1100 1010, then 1001 0111. The number of times an overwrite must be accomplished depends on the storage media, sometimes on its sensitivity, and sometimes on differing DoD component requirements, but seven times is often recommended. *Answer “Applying a concentration of hydriodic acid (55% to 58% solution) to the gamma ferric oxide disk surface” is a rarely used method of media destruction, and acid solutions should be used in a well-ventilated area only by qualified personnel. *Answer “Making sure the disk is re-circulated as quickly as possible to prevent object reuse” is wrong. Source: NCSC-TG-025 A Guide to Understanding Data Remanence in Automated Information Systems.

NO.251 Match the objectives to the assessment questions in the governance domain of Software Assurance Maturity Model (SAMM).

Explanation

NO.252 Which choice below is NOT an element of BCP plan approval and implementation?

 Executing a disaster scenario and documenting the results

 Obtaining senior management approval of the results

 Creating an awareness of the plan

 Updating the plan regularly and as needed

Answer “Executing a disaster scenario and documenting the results” is a distracter, although it could be considered a loose description of disaster recovery plan testing.
The other three choices are primary elements of BCP approval,
implementation, and maintenance.

NO.253 PGP provides which of the following?(Choose three)

 Confidentiality

 Accountability

 Accessibility

 Integrity

 Interest

 Non-repudiation

 Authenticity

PGP provides confidentiality, integrity, and authenticity.

NO.254 Which of the following statements pertaining to stream ciphers is correct?

 A stream cipher is a type of asymmetric encryption algorithm.

 A stream cipher generates what is called a keystream.

 A stream cipher is slower than a block cipher.

 A stream cipher is not appropriate for hardware-based encryption.

A stream cipher is a type of symmetric encryption algorithm that operates on continuous streams of plain text and is appropriate for hardware-based encryption.
Stream ciphers can be designed to be exceptionally fast, much faster than any block cipher. A stream cipher generates what is called a keystream (a sequence of bits used as a key).
Stream ciphers can be viewed as approximating the action of a proven unbreakable cipher, the one-time pad (OTP), sometimes known as the Vernam cipher. A one-time pad uses a keystream of completely random digits. The keystream is combined with the plaintext digits one at a time to form the ciphertext. This system was proved to be secure by Claude
Shannon in 1949. However, the keystream must be (at least) the same length as the plaintext, and generated completely at random. This makes the system very cumbersome to implement in practice, and as a result the one-time pad has not been widely used, except for the most critical applications.
A stream cipher makes use of a much smaller and more convenient key – 128 bits, for example. Based on this key, it generates a pseudorandom keystream which can be combined with the plaintext digits in a similar fashion to the one-time pad. However, this comes at a cost: because the keystream is now pseudorandom, and not truly random, the proof of security associated with the one-time pad no longer holds: it is quite possible for a stream cipher to be completely insecure if it is not implemented properly as we have seen with the Wired Equivalent Privacy (WEP) protocol.
Encryption is accomplished by combining the keystream with the plaintext, usually with the bitwise XOR operation.
Source: DUPUIS, Clement, CISSP Open Study Guide on domain 5, cryptography, April
1999.
More details can be obtained on Stream Ciphers in RSA Security’s FAQ on Stream
Ciphers.

 Loading …

The CISSP certification is highly valued in the industry and is recognized by many organizations around the world. It is considered to be a benchmark for information security professionals and is often required by employers when hiring for information security positions. Certified Information Systems Security Professional (CISSP) certification demonstrates that the holder has the knowledge and skills needed to protect their organization’s information assets from a wide range of threats.

Tested Material Used To CISSP Test Engine: https://www.actualpdf.com/CISSP_exam-dumps.html

         

Related Links: myportal.utt.edu.tt myportal.utt.edu.tt myportal.utt.edu.tt www.stes.tyc.edu.tw myportal.utt.edu.tt myportal.utt.edu.tt