QUESTION: 385 Topic: 2, Security Operation Adimnistration

Which of the following is not a form of passive attack?

Scavenging
Data diddling
Shoulder surfing
Sniffing

Answer(s): B

Explanation:

Data diddling involves alteration of existing data and is extremely common. It is one of the easiest types of crimes to prevent by using access and accounting controls, supervision, auditing, separation of duties, and authorization limits. It is a form of active attack. All other choices are examples of passive attacks, only affecting confidentiality.

Reference:

HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, Chapter 10: Law, Investigation, and Ethics (page 645).

Reveal Solution Next Question

QUESTION: 386 Topic: 2, Security Operation Adimnistration

Which of the following statements pertaining to a security policy is incorrect?

Its main purpose is to inform the users, administrators and managers of their obligatory requirements for protecting technology and information assets.
It specifies how hardware and software should be used throughout the organization.
It needs to have the acceptance and support of all levels of employees within the organization in order for it to be appropriate and effective.
It must be flexible to the changing environment.

Answer(s): B

Explanation:

A security policy would NOT define how hardware and software should be used throughout the organization. A standard or a procedure would provide such details but not a policy.
A security policy is a formal statement of the rules that people who are given access to anorganization's technology and information assets must abide. The policy communicates the security goals to all of the users, the administrators, and the managers. The goals will be largely determined by the following key tradeoffs: services offered versus security provided, ease of use versus security, and cost of security versus risk of loss.
The main purpose of a security policy is to inform the users, the administrators and the managers of their obligatory requirements for protecting technology and information assets.
The policy should specify the mechanisms through which these requirements can be met. Another purpose is to provide a baseline from which to acquire, configure and audit computer systems and networks for compliance with the policy. In order for a security policy to be appropriate and effective, it needs to have the acceptance and support of all levels of employees within the organization. A good security policy must:
· Be able to be implemented through system administration procedures, publishing of acceptable use guidelines, or other appropriate methods
· Be able to be enforced with security tools, where appropriate, and with sanctions, where actual prevention is not technically feasible
· Clearly define the areas of responsibility for the users, the administrators, and the managers · Be communicated to all once it is established
· Be flexible to the changing environment of a computer network since it is a living document

Reference:

National Security Agency, Systems and Network Attack Center (SNAC),The 60 Minute Network Security Guide, February 2002, page 7.
or
A local copy is kept at:
https://www.freepracticetests.org/documents/The%2060%20Minute%20Network%20Security%20 Guide.pdf

Reveal Solution Next Question

QUESTION: 387 Topic: 2, Security Operation Adimnistration

Which of the following statements pertaining to software testing is incorrect?

Unit testing should be addressed and considered when the modules are being designed.
Test data should be part of the specifications.
Testing should be performed with live data to cover all possible situations.
Test data generators can be used to systematically generate random test data that can be used to test programs.

Answer(s): C

Explanation:

Live or actual field data is not recommended for use in the testing procedures because both data types may not cover out of range situations and the correct outputs of the test are unknown. Live data would not be the best data to use because of the lack of anomalies and also because of the risk of exposure to your live data.

Reference:

KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, John Wiley & Sons, 2001, Chapter 7: Applications and Systems Development (page 251).

Reveal Solution Next Question

QUESTION: 388 Topic: 2, Security Operation Adimnistration

Which of the following can be defined as the process of rerunning a portion of the test scenario or test plan to ensure that changes or corrections have not introduced new errors?

Unit testing
Pilot testing
Regression testing
Parallel testing

Answer(s): C

Explanation:

Regression testing is the process of rerunning a portion of the test scenario or test plan to ensure that changes or corrections have not introduced new errors. The data used in regression testing should be the same as the data used in the original test. Unit testing refers to the testing of an individual program or module. Pilot testing is a preliminary test that focuses only on specific and predetermined aspects of a system. Parallel testing is the process of feeding test data into two systems and comparing the results.

Reference:

Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, Chapter 6: Business Application System Development, Acquisition, Implementation and Maintenance (page 300).

Reveal Solution Next Question

Free SSCP Exam Braindumps (page: 97)

QUESTION: 385 Topic: 2, Security Operation Adimnistration

Explanation:

Reference:

QUESTION: 386 Topic: 2, Security Operation Adimnistration

Explanation:

Reference:

QUESTION: 387 Topic: 2, Security Operation Adimnistration

Explanation:

Reference:

QUESTION: 388 Topic: 2, Security Operation Adimnistration

Explanation:

Reference: