ExamDumpsVCE CSSLP Exam Questions | Real CSSLP Practice Dumps
Verified CSSLP Exam Dumps Q&As - Provide CSSLP with Correct Answers
Target Audience
The target candidates for the CSSLP certification are the professionals with the expertise in incorporating security practices, including auditing, authentication, and authorization, into different phases of SDLC (Software Development Lifecycle). This certificate covers software design all through to the implementation stage, testing, and deployment.
NEW QUESTION # 25
The DoD 8500 policy series represents the Department's information assurance strategy. Which of the following objectives are defined by the DoD 8500 series? Each correct answer represents a complete solution. Choose all that apply.
- A. Defending systems
- B. Providing command and control and situational awareness
- C. Protecting information
- D. Providing IA Certification and Accreditation
Answer: A,B,C
Explanation:
Explanation/Reference:
Explanation: The various objectives of the DoD 8500 series are as follows: Protecting information Defending systems Providing command and control and situational awareness Making sure that the information assurance is integrated into processes Increasing security awareness throughout the DoD's workforce
NEW QUESTION # 26
Which of the following documents is defined as a source document, which is most useful for the ISSE when classifying the needed security functionality?
- A. Information Protection Policy (IPP)
- B. CONOPS
- C. IMM
- D. System Security Context
Answer: A
Explanation:
The Information Protection Policy (IPP) is defined as a source document, which is most useful for the ISSE when classifying the needed security functionality. The IPP document consists of the threats to the information management and the security services and controls needed to respond to those threats. Answer B is incorrect. The IMM is the source document describing the customer's needs based on identifying users, processes, and information. Answer C is incorrect. The System Security Context is the output of SE and ISSEP. It is the translation of the requirements into system parameters and possible measurement concepts that meet the defined requirements. Answer D is incorrect. The Concept of Operations (CONOPS) is a document describing the characteristics of a proposed system from the viewpoint of an individual who will use that system. It is used to communicate the quantitative and qualitative system characteristics to all stakeholders. CONOPS are widely used in the military or in government services, as well as other fields. A CONOPS generally evolves from a concept and is a description of how a set of capabilities may be employed to achieve desired objectives or a particular end state for a specific scenario.
NEW QUESTION # 27
In which of the following SDLC phases is the system's security features configured and enabled, the system is tested and installed or fielded, and the system is authorized for processing?
- A. Implementation Phase
- B. Operation/Maintenance Phase
- C. Initiation Phase
- D. Development/Acquisition Phase
Answer: A
Explanation:
Explanation/Reference:
Explanation: It is the implementation phase, in which the system's security features are configured and enabled, the system is tested and installed or fielded, and the system is authorized for processing. A design review and systems test should be performed prior to placing the system into operation to ensure that it meets security specifications. AnswerB is incorrect. In Operation/Maintenance Phase, the system performs its work. The system is almost always being continuously modified by the addition of hardware and software and by numerous other events. Answer D is incorrect. In the initiation phase, the need for a system is expressed and the purpose of the system is documented. Answer: A is incorrect. In Development/Acquisition Phase, the system is designed, purchased, programmed, developed, or otherwise constructed.
NEW QUESTION # 28
Which of the following coding practices are helpful in simplifying code? Each correct answer represents a complete solution. Choose all that apply.
- A. Software should avoid ambiguities and hidden assumptions, recursions, and GoTo statements.
- B. Programmers should use multiple small and simple functions rather than a single complex function.
- C. Processes should have multiple entry and exit points.
- D. Programmers should implement high-consequence functions in minimum required lines of code and follow proper coding standards.
Answer: A,B,C,D
Explanation:
The various coding practices that are helpful in simplifying the code are as follows: Programmers should implement high-consequence functions in minimum required lines of code and follow the proper coding standards. Software should implement the functions that are defined in the software specification. Software should avoid ambiguities and hidden assumptions, recursion, and GoTo statements. Programmers should use multiple small and simple functions rather than a complex function. The processes should have only one entry point and minimum exit points. Interdependencies should be minimum so that a process module or component can be disabled when it is not needed, or replaced when it is found insecure or a better alternative is available, without disturbing the software operations. Programmers should use object-oriented techniques to keep the code simple and small. Some of the object-oriented techniques are object inheritance, encapsulation, and polymorphism. Answer D is incorrect. Processes should have only one entry point and the minimum number of exit points.
NEW QUESTION # 29
Which of the following DoD directives is referred to as the Defense Automation Resources Management Manual?
- A. DoD 8910.1
- B. DoD 5200.22-M
- C. DoDD 8000.1
- D. DoD 5200.1-R
- E. DoD 7950.1-M
Answer: E
Explanation:
Explanation/Reference:
Explanation: The various DoD directives are as follows:
DoD 5200.1-R: This DoD directive refers to the 'Information Security Program Regulation'. DoD 5200.22- M: This DoD directive refers the 'National Industrial Security Program Operating Manual'. DoD 7950.1-M:
This DoD directive refers to the 'Defense Automation Resources Management Manual'. DoDD 8000.1: This DoD directive refers to the 'Defense Information Management (IM) Program'. DoD 8910.1: This DoD directive refers to the 'Management and Control of Information Requirements'.
NEW QUESTION # 30
Which of the following processes does the decomposition and definition sequence of the Vee model include? Each correct answer represents a part of the solution. Choose all that apply.
- A. High level software design
- B. Security requirements allocation
- C. Component integration and test
- D. System security analysis
Answer: A,B,D
Explanation:
Decomposition and definition sequence includes the following processes: System security analysis Security requirements allocation Software security requirements analysis High level software design Detailed software design Answer A is incorrect. This process is included in the integration and verification sequence of the Vee model.
NEW QUESTION # 31
In which of the following deployment models of cloud is the cloud infrastructure operated exclusively for an organization?
- A. Hybrid cloud
- B. Community cloud
- C. Private cloud
- D. Public cloud
Answer: C
Explanation:
In private cloud, the cloud infrastructure is operated exclusively for an organization.
The private cloud infrastructure is administered by the organization or a third party, and exists on premise and off premise.
NEW QUESTION # 32
Which of the following is a chronological record of system activities to enable the reconstruction and examination of the sequence of events and/or changes in an event?
- A. Detective controls
- B. Security audit
- C. Explanation:
Audit trail or audit log is a chronological sequence of audit records, each of which contains evidence directly pertaining to and resulting from the execution of a business process or system function. Audit records typically result from activities such as transactions or communications by individual people, systems, accounts, or other entities. The process that creates audit trail should always run in a privileged mode, so it could access and supervise all actions from all users, and normal user could not stop/change it. Furthermore, for the same reason, trail file or database table with a trail should not be accessible to normal users. Answer C is incorrect. A computer security audit is a manual or systematic measurable technical assessment of a system or application. Manual assessments include interviewing staff, performing security vulnerability scans, reviewing application and operating system access controls, and analyzing physical access to the systems. Automated assessments, or CAAT's, include system generated audit reports or using software to monitor and report changes to files and settings on a system. Systems can include personal computers, servers, mainframes, network routers, and switches. - D. Corrective controls
- E. Audit trail
Answer: E
Explanation:
is incorrect. Detective controls are the audit controls that are not needed to be restricted. Any control that performs a monitoring activity can likely be defined as a Detective Control. For example, it is possible that mistakes, either intentional or unintentional, can be made. Therefore, an additional Protective control is that these companies must have their financial results audited by an independent Certified Public Accountant. The role of this accountant is to act as an auditor. In fact, any auditor acts as a Detective control. If the organization in question has not properly followed the rules, a diligent auditor should be able to detect the deficiency which indicates that some control somewhere has failed. Answer A is incorrect. Reactive or corrective controls typically work in response to a detective control, responding in such a way as to alert or otherwise correct an unacceptable condition. Using the example of account rules, either the internal Audit Committee or the SEC itself, based on the report generated by the external auditor, will take some corrective action. In this way, they are acting as a Corrective or Reactive control.
NEW QUESTION # 33
Which of the following classification levels defines the information that, if disclosed to the unauthorized parties, could be reasonably expected to cause exceptionally grave damage to the national security?
- A. Secret information
- B. Confidential information
- C. Top Secret information
- D. Unclassified information
Answer: C
Explanation:
Explanation/Reference:
Explanation: Top Secret information is the highest level of classification of material on a national level.
Such material would cause "exceptionally grave damage" to national security if publicly available. Answer:
A is incorrect. Secret information is that, if disclosed to unauthorized parties, could be expected to cause serious damage to the national security, but it is not the best answer for the above question. AnswerC is incorrect. Such material would cause "damage" or be "prejudicial" to national security if publicly available.
AnswerB is incorrect. Unclassified information, technically, is not a classification level, but is used for
government documents that do not have a classification listed above. Such documents can sometimes be viewed by those without security clearance.
NEW QUESTION # 34
The Project Risk Management knowledge area focuses on which of the following processes? Each correct answer represents a complete solution. Choose all that apply.
- A. Risk Monitoring and Control
- B. Risk Management Planning
- C. Potential Risk Monitoring
- D. Quantitative Risk Analysis
Answer: A,B,D
Explanation:
Explanation/Reference:
Explanation: The Project Risk Management knowledge area focuses on the following processes: Risk Management Planning Risk Identification Qualitative Risk Analysis Quantitative Risk Analysis Risk Response Planning Risk Monitoring and Control AnswerD is incorrect. There is no such process in the Project Risk Management knowledge area.
NEW QUESTION # 35
What are the subordinate tasks of the Initiate and Plan IA C&A phase of the DIACAP process? Each correct answer represents a complete solution. Choose all that apply.
- A. Assign IA controls.
- B. Register system with DoD Component IA Program.
- C. Initiate IA implementation plan
- D. Assemble DIACAP team
- E. Conduct validation activity.
- F. Develop DIACAP strategy
Answer: A,B,C,D,F
Explanation:
Explanation/Reference:
Explanation: The Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) is a process defined by the United States Department of Defense (DoD) for managing risk.
The subordinate tasks of the Initiate and Plan IA C&A phase are as follows: Register system with DoD Component IA Program. Assign IA controls. Assemble DIACAP team. Develop DIACAP strategy. Initiate IA implementation plan. Answer: F is incorrect. Validation activities are conducted in the second phase of the DIACAP process, i.e., Implement and Validate Assigned IA Controls.
NEW QUESTION # 36
Which of the following is an attack with IP fragments that cannot be reassembled?
- A. Teardrop attack
- B. Smurf attack
- C. Password guessing attack
- D. Dictionary attack
Answer: A
Explanation:
Teardrop is an attack with IP fragments that cannot be reassembled. In this attack, corrupt packets are sent to the victim's computer by using IP's packet fragmentation algorithm. As a result of this attack, the victim's computer might hang. Answer D is incorrect. Smurf is an ICMP attack that involves spoofing and flooding. Answer C is incorrect. Dictionary attack is a type of password guessing attack. This type of attack uses a dictionary of common words to find out the password of a user. It can also use common words in either upper or lower case to find a password. There are many programs available on the Internet to automate and execute dictionary attacks. Answer A is incorrect. A password guessing attack occurs when an unauthorized user tries to log on repeatedly to a computer or network by guessing usernames and passwords. Many password guessing programs that attempt to break passwords are available on the Internet. Following are the types of password guessing attacks: Brute force attack Dictionary attack
NEW QUESTION # 37
Security is a state of well-being of information and infrastructures in which the possibilities of successful yet undetected theft, tampering, and/or disruption of information and services are kept low or tolerable. Which of the following are the elements of security? Each correct answer represents a complete solution. Choose all that apply.
- A. Confidentiality
- B. Integrity
- C. Authenticity
- D. Availability
Answer: A,B,C,D
Explanation:
The elements of security are as follows: 1.Confidentiality: It is the concealment of information or resources. 2.Authenticity: It is the identification and assurance of the origin of information. 3.Integrity: It refers to the trustworthiness of data or resources in terms of preventing improper and unauthorized changes. 4.Availability: It refers to the ability to use the information or resources as desired.
NEW QUESTION # 38
In 2003, NIST developed a new Certification & Accreditation (C&A) guideline known as FIPS 199. What levels of potential impact are defined by FIPS 199? Each correct answer represents a complete solution. Choose all that apply.
- A. Moderate
- B. Medium
- C. High
- D. Low
Answer: B,C,D
Explanation:
In 2003, NIST developed a new Certification & Accreditation (C&A) guideline known as FIPS 199. FIPS 199 is a standard for security categorization of Federal Information and Information Systems. It defines three levels of potential impact: Low: It causes a limited adverse effect. Medium: It causes a serious adverse effect. High: It causes a severe adverse effect.
NEW QUESTION # 39
In which of the following testing methodologies do assessors use all available documentation and work under no constraints, and attempt to circumvent the security features of an information system?
- A. Penetration test
- B. Walk-through test
- C. Paper test
- D. Full operational test
Answer: A
Explanation:
Explanation/Reference:
Explanation: A penetration testing is a method of evaluating the security of a computer system or network by simulating an attack from a malicious source. The process involves an active analysis of the system for any potential vulnerabilities that may result from poor or improper system configuration, known or unknown hardware or software flaws, or operational weaknesses in process or technical countermeasures. This analysis is carried out from the position of a potential attacker, and can involve active exploitation of security vulnerabilities. Any security issues that are found will be presented to the system owner together with an assessment of their impact and often with a proposal for mitigation or a technical solution. The intent of a penetration test is to determine feasibility of an attack and the amount of business impact of a successful exploit, if discovered. It is a component of a full security audit. Answer: C is incorrect. A paper test is the least complex test in the disaster recovery and business continuity testing approaches. In this test, the BCP/DRP plan documents are distributed to the appropriate managers and BCP/DRP team members for review, markup, and comment. This approach helps the auditor to ensure that the plan is complete and that all team members are familiar with their responsibilities within the plan. Answer: D is incorrect. A walk-through test is an extension of the paper testing in the business continuity and disaster recovery process. In this testing methodology, appropriate managers and BCP/DRP team members discuss and walk through procedures of the plan. They also discuss the training needs, and clarification of critical plan elements. Answer: A is incorrect. A full operational test includes all team members and participants in the disaster recovery and business continuity process. This full operation test involves the mobilization of personnel. It restores operations in the same manner as an outage or disaster would. The full operational test extends the preparedness test by including actual notification, mobilization of resources, processing of data, and utilization of backup media for restoration.
NEW QUESTION # 40
Which of the following statements about a host-based intrusion prevention system (HIPS) are true? Each correct answer represents a complete solution. Choose two.
- A. It can detect events scattered over the network.
- B. It can handle encrypted and unencrypted traffic equally.
- C. It is a technique that allows multiple computers to share one or more IP addresses.
- D. It cannot detect events scattered over the network.
Answer: B,D
Explanation:
A host-based intrusion prevention system (HIPS) is an application usually employed on a single computer. It complements traditional finger- print-based and heuristic antivirus detection methods, since it does not need continuous updates to stay ahead of new malware. When a malicious code needs to modify the system or other software residing on the machine, a HIPS system will notice some of the resulting changes and prevent the action by default or notify the user for permission. It can handle encrypted and unencrypted traffic equally and cannot detect events scattered over the network. Answer B is incorrect. Network address translation (NAT) is a technique that allows multiple computers to share one or more IP addresses. NAT is configured at the server between a private network and the Internet. It allows the computers in a private network to share a global, ISP assigned address. NAT modifies the headers of packets traversing the server. For packets outbound to the Internet, it translates the source addresses from private to public, whereas for packets inbound from the Internet, it translates the destination addresses from public to private. Answer A is incorrect. Network intrusion prevention system (NIPS) is a hardware/software platform that is designed to analyze, detect, and report on security related events. NIPS is designed to inspect traffic and based on its configuration or security policy, it can drop malicious traffic. NIPS is able to detect events scattered over the network and can react.
NEW QUESTION # 41
You work as the Senior Project manager in Dotcoiss Inc. Your company has started a software project using configuration management and has completed 70% of it. You need to ensure that the network infrastructure devices and networking standards used in this project are installed in accordance with the requirements of its detailed project design documentation. Which of the following procedures will you employ to accomplish the task?
- A. Configuration control
- B. Functional configuration audit
- C. Configuration identification
- D. Physical configuration audit
Answer: D
Explanation:
Explanation/Reference:
Explanation: Physical Configuration Audit (PCA) is one of the practices used in Software Configuration Management for Software Configuration Auditing. The purpose of the software PCA is to ensure that the design and reference documentation is consistent with the as-built software product. PCA checks and matches the really implemented layout with the documented layout. AnswerC is incorrect. Functional Configuration Audit or FCA is one of the practices used in Software Configuration Management for Software Configuration Auditing. FCA occurs either at delivery or at the moment of effecting the change. A Functional Configuration Audit ensures that functional and performance attributes of a configuration item are achieved. Answer B is incorrect. Configuration control is a procedure of the Configuration management. Configuration control is a set of processes and approval stages required to change a configuration item's attributes and to re-baseline them. It supports the change of the functional and physical attributes of software at various points in time, and performs systematic control of changes to the identified attributes. Answer: A is incorrect. Configuration identification is the process of identifying the attributes that define every aspect of a configuration item. A configuration item is a product (hardware and/ or software) that has an end-user purpose. These attributes are recorded in configuration documentation and baselined. Baselining an attribute forces formal configuration change control processes to be effected in the event that these attributes are changed.
NEW QUESTION # 42
The Data and Analysis Center for Software (DACS) specifies three general principles for software assurance which work as a framework in order to categorize various secure design principles. Which of the following principles and practices does the General Principle 1 include? Each correct answer represents a complete solution. Choose two.
- A. Assume environment data is not trustworthy
- B. Principle of least privilege
- C. Principle of separation of privileges, duties, and roles
- D. Simplify the design
Answer: B,C
Explanation:
Explanation/Reference:
Explanation: General Principle 1- Minimize the number of high-consequence targets includes the following principles and practices:
Principle of least privilege Principle of separation of privileges, duties, and roles Principle of separation of domains AnswerB is incorrect. Assume environment data is not trustworthy principle is included in the General Principle 2. Answer: C is incorrect. Simplify the design principle is included in the General Principle 3.
NEW QUESTION # 43
Which of the following access control models are used in the commercial sector? Each correct answer represents a complete solution. Choose two.
- A. Clark-Wilson model
- B. Clark-Biba model
- C. Biba model
- D. Bell-LaPadula model
Answer: A,C
Explanation:
The Biba and Clark-Wilson access control models are used in the commercial sector. The Biba model is a formal state transition system of computer security policy that describes a set of access control rules designed to ensure data integrity. Data and subjects are grouped into ordered levels of integrity. The model is designed so that subjects may not corrupt data in a level ranked higher than the subject, or be corrupted by data from a lower level than the subject. The Clark-Wilson security model provides a foundation for specifying and analyzing an integrity policy for a computing system. Answer D is incorrect. The Bell-LaPadula access control model is mainly used in military systems. Answer B is incorrect. There is no such access control model as Clark-Biba.
NEW QUESTION # 44
Martha registers a domain named Microsoft.in. She tries to sell it to Microsoft Corporation. The infringement of which of the following has she made?
- A. Copyright
- B. Patent
- C. Trademark
- D. Intellectual property
Answer: C
Explanation:
According to the Lanham Act, domain names fall under trademarks law. A new section 43(d) of the Trademark Act (Lanham Act) states that anyone who in bad faith registers, traffics in, or uses a domain name that infringes or dilutes another's trademark has committed trademark infringement. Factors involved in assessing bad faith focus on activities typically associated with cyberpiracy or cybersquatting, such as whether the registrant has offered to sell the domain name to the trademark holder for financial gain without having used or intended to use it for a bona fide business; whether the domain-name registrant registered multiple domain names that are confusingly similar to the trademarks of others; and whether the trademark incorporated in the domain name is distinctive and famous. Other factors are whether the domain name consists of the legal name or common handle of the domain-name registrant and whether the domain-name registrant previously used the mark in connection with a bona fide business.
NEW QUESTION # 45
The Web resource collection is a security constraint element summarized in the Java Servlet Specification v2.4. Which of the following elements does it include? Each correct answer represents a complete solution. Choose two.
- A. HTTP methods
- B. Role names
- C. URL patterns
- D. Transport guarantees
Answer: A,C
Explanation:
Web resource collection is a set of URL patterns and HTTP operations that define all resources required to be protected. It is a security constraint element summarized in the Java Servlet Specification v2.4. The Web resource collection includes the following elements: URL patterns HTTP methods Answer B is incorrect. An authorization constraint includes role names. Answer C is incorrect. A user data constraint includes transport guarantees.
NEW QUESTION # 46
Which of the following are the tasks performed by the owner in the information classification schemes? Each correct answer represents a part of the solution. Choose three.
- A. To delegate the responsibility of the data safeguard duties to the custodian.
- B. To review the classification assignments from time to time and make alterations as the business requirements alter.
- C. To make original determination to decide what level of classification the information requires, which is based on the business requirements for the safety of the data.
- D. To perform data restoration from the backups whenever required.
Answer: A,B,C
Explanation:
The different tasks performed by the owner are as follows: He makes the original determination to decide what level of classification the information requires, which is based on the business requirements for the safety of the data. He reviews the classification assignments from time to time and makes alterations as the business needs change. He delegates the responsibility of the data safeguard duties to the custodian. He specifies controls to ensure confidentiality, integrity and availability. Answer C is incorrect. This task is performed by the custodian and not by the owner.
NEW QUESTION # 47
In which of the following cryptographic attacking techniques does an attacker obtain encrypted messages that have been encrypted using the same encryption algorithm?
- A. Chosen ciphertext attack
- B. Known plaintext attack
- C. Chosen plaintext attack
- D. Ciphertext only attack
Answer: D
Explanation:
In a ciphertext only attack, an attacker obtains encrypted messages that have been encrypted using the same encryption algorithm.
NEW QUESTION # 48
What are the various benefits of a software interface according to the "Enhancing the Development Life Cycle to Produce Secure Software" document? Each correct answer represents a complete solution.
Choose three.
- A. It controls the accessing of a component.
- B. It displays the implementation details of a component.
- C. It modifies the implementation of a component without affecting the specifications of the interface.
- D. It provides a programmatic way of communication between the components that are working with different programming languages.
Answer: A,C,D
Explanation:
Explanation/Reference:
Explanation: The benefits of a software interface are as follows: It provides a programmatic way of communication between the components that are working with different programming languages. It prevents direct communication between components. It modifies the implementation of a component without affecting the specifications of the interface. It hides the implementation details of a component. It controls the accessing of a component. AnswerC is incorrect. A software interface hides the implementation details of the component.
NEW QUESTION # 49
Which of the following security models dictates that subjects can only access objects through applications?
- A. Bell-LaPadula
- B. Clark-Wilson
- C. Biba-Clark model
- D. Biba model
Answer: B
Explanation:
The Clark-Wilson security model dictates that subjects can only access objects through applications. Answer A is incorrect. The Biba model does not let subjects write to objects at a higher integrity level. Answer B is incorrect. The Bell-LaPadula model has a simple security rule, which means a subject cannot read data from a higher level. Answer D is incorrect. There is no such model as Biba-Clark model.
NEW QUESTION # 50
......
Get Top-Rated ISC CSSLP Exam Dumps Now: https://braindump2go.examdumpsvce.com/CSSLP-valid-exam-dumps.html
