What is the PRIMARY reason to maintain the chain of custody on evidence that has been collected?
Answer(s): C
This is the PRIMARY reason for the chain of custody of evidence. Evidence must be controlled every step of the way. If it is not, the evidence can be tampered with and ruled inadmissable. The Chain of Custody will include a detailed record of:Who obtained the evidenceWhat was the evidenceWhere and when the evidence was obtainedWho secured the evidenceWho had control or possession of the evidenceThe following answers are incorrect because :To ensure that no evidence is lost is incorrect as it is not the PRIMARY reason. To ensure that all possible evidence is gathered is also incorrect as it is not the PRIMARY reason. To ensure that incidents were handled with due care and due diligence is also incorrect as it is also not the PRIMARY reason.The chain of custody is a history that shows how evidence was collected, analyzed, transported, and preserved in order to establish that it is sufficiently trustworthy to be presented as evidence in court. Because electronic evidence can be easily modified, a clearly defined chain of custody demonstrates that the evidence is trustworthy which would make it admissible in court.
Shon Harris AIO v3 , Chapter-10: Law, Investigation, and Ethics , Page : 727
Which of the following would BEST be defined as an absence or weakness of safeguard that could be exploited?
Answer(s): B
It is a software , hardware or procedural weakness that may provide an attacker the open door he is looking for to enter a computer or network and have unauthorized access to resources within the environment. A vulnerability characterizes the absence or weakness of a safeguard that could be exploited. This vulnerability may be a service running on a server, unpatched applications or operating system software etc.The following answers are incorrect because:Threat: A threat is defined as a potential danger to information or systems. The threat is someone or something will identify a specific vulnerability and use it against the company or individual. The entity that takes advantage of a vulnerability is referred to as a 'Threat Agent'. A threat agent could be an intruder accessing the network through a port on the firewall , a process accessing data that violates the security policy.Risk:A risk is the likelihood of a threat agent taking advantage of a vulnerability and the corresponding business impact. If a firewall has several ports open , there is a higher likelihood that an intruder will use one to access the network in an unauthorized method.Exposure: An exposure is an instance of being exposed to losses from a threat agent.
SHON HARRIS , ALL IN ONE THIRD EDITION : Chapter 3 : Security Management Practices , Pages: 57-59
Which of the following could be BEST defined as the likelihood of a threat agent taking advantage of a vulnerability?
Answer(s): A
Risk is the likelihood of a threat agent taking advantage of a vulnerability and thecorresponding business impact. If a firewall has several ports open , there is a higher likelihood that an intruder will use one to access the network in an unauthorized method.The following answers are incorrect :Residual Risk is very different from the notion of total risk. Residual Risk would be the risks that still exists after countermeasures have been implemented. Total risk is the amount of risk a company faces if it chooses not to implement any type of safeguard.Exposure: An exposure is an instance of being exposed to losses from a threat agent.Countermeasure: A countermeasure or a safeguard is put in place to mitigate the potential risk. Examples of countermeasures include strong password management , a security guard.
SHON HARRIS ALL IN ONE 3rd EDITIONChapter - 3: Security Management Practices , Pages : 57-59
Which approach to a security program ensures people responsible for protecting the company's assets are DRIVING the program?
A security program should use a top-down approach, meaning that the initiation, support, and direction come from top management; work their way through middle management; and then reach staff members.In contrast, a bottom-up approach refers to a situation in which staff members (usually IT ) try to develop a security program without getting proper management support and direction. A bottom- up approach is commonly less effective, not broad enough to address all security risks, and doomed to fail.A top-down approach makes sure the people actually responsible for protecting the company's assets (senior management) are driving the program.The following are incorrect answers:The Delphi approach is incorrect as this is for a brainstorming technique.The bottom-up approach is also incorrect as this approach would be if the IT department tried to develop a security program without proper support from upper management.The technology approach is also incorrect as it does not fit into the category of best answer.
Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 63). McGraw-Hill. Kindle Edition.
Which of the following is NOT a part of a risk analysis?
Answer(s): D
This step is not a part of RISK ANALYSIS. A risk analysis has three main goals: identify risks, quantify the impact of potential threats, and provide an economic balance between the impact of the risk and the cost of the associated countermeasure. Choosing the best countermeasure is not part of the risk analysis.
HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter 3: Security Management Practices (page 73).HARRIS, Shon, Mike Meyers' CISSP(R) Certification Passport, 2002, McGraw-Hill, page 12.
Post your Comments and Discuss ISC SSCP exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SSCP content, but please register or login to continue.