QUESTION: 144

A security policy is an overall general statement produced by senior management that dictates what role security plays within the organization. Which of the following are required to be addressed in a well designed policy?
Each correct answer represents a part of the solution. Choose all that apply.

What is being secured
Who is expected to comply with the policy
Where is the vulnerability, threat, or risk
Who is expected to exploit the vulnerability

Answer(s): A,B,C

Show Answer Next Question

QUESTION: 145

The functional analysis process is used for translating system requirements into detailed function criteria. Which of the following are the elements of functional analysis process?
Each correct answer represents a complete solution. Choose all that apply.

Model possible overall system behaviors that are needed to achieve the system requirements.
Develop concepts and alternatives that are not technology or component bound.
Decompose functional requirements into discrete tasks or activities, the focus is still on technology not functions or components.
Use a top-down with some bottom-up approach verification.

Answer(s): A,B,D

Show Answer Next Question

QUESTION: 146

The Information System Security Officer (ISSO) and Information System Security Engineer (ISSE) play the role of a supporter and advisor, respectively. Which of the following statements are true about ISSO and ISSE?
Each correct answer represents a complete solution. Choose all that apply.

An ISSE manages the security of the information system that is slated for Certification & Accreditation (C&A).
An ISSE provides advice on the impacts of system changes.
An ISSE provides advice on the continuous monitoring of the information system.
An ISSO manages the security of the information system that is slated for Certification & Accreditation (C&A).
An ISSO takes part in the development activities that are required to implement system changes.

Answer(s): B,C,D

Show Answer Next Question

QUESTION: 136

Which of the following laws is the first to implement penalties for the creator of viruses, worms, and other types of malicious code that causes harm to the computer systems?

Computer Fraud and Abuse Act
Computer Security Act
Gramm-Leach-Bliley Act
Digital Millennium Copyright Act

Answer(s): A

Show Answer Next Question

QUESTION: 147

Which of the following processes describes the elements such as quantity, quality, coverage, timelines, and availability, and categorizes the different functions that the system will need to perform in order to gather the documented missionbusiness needs?

Functional requirements
Operational scenarios
Human factors
Performance requirements

Answer(s): A

Show Answer Next Question

QUESTION: 149

What NIACAP certification levels are recommended by the certifier?
Each correct answer represents a complete solution.
Choose all that apply.

Basic System Review
Basic Security Review
Maximum Analysis
Comprehensive Analysis
Detailed Analysis
Minimum Analysis

Answer(s): B,D,E,F

Show Answer Next Question

QUESTION: 150

Which of the following processes provides a standard set of activities, general tasks, and a management structure to certify and accredit systems, which maintain the information assurance and the security posture of a system or site?

ASSET
NSA-IAM
NIACAP
DITSCAP

Answer(s): C

Show Answer Next Question

QUESTION: 151

Della works as a security engineer for BlueWell Inc. She wants to establish configuration management and control procedures that will document proposed or actual changes to the information system. Which of the following phases of NIST SP 800-37 C&A methodology will define the above task?

Security Certification
Security Accreditation
Initiation
Continuous Monitoring

Answer(s): D

Show Answer Next Question

Free ISC CISSP-ISSEP Exam Questions (page: 3)

QUESTION: 144

QUESTION: 145

QUESTION: 146

QUESTION: 136

QUESTION: 147

QUESTION: 149

QUESTION: 150

QUESTION: 151

CISSP-ISSEP Exam Discussions & Posts