In what way could Java applets pose a security threat?
Answer(s): C
TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.
Which of the following is needed for System Accountability?
Answer(s): A
Is a means of being able to track user actions. Through the use of audit logs and other tools the user actions are recorded and can be used at a later date to verify what actions were performed.Accountability is the ability to identify users and to be able to track user actions.The following answers are incorrect:Documented design as laid out in the Common Criteria. Is incorrect because the Common Criteria is an international standard to evaluate trust and would not be a factor in System Accountability.Authorization. Is incorrect because Authorization is granting access to subjects, just because you have authorization does not hold the subject accountable for their actions.Formal verification of system design. Is incorrect because all you have done is to verify the system design and have not taken any steps toward system accountability.
OIG CBK Glossary (page 778)
A timely review of system access audit records would be an example of which of the basic security functions?
Answer(s): D
By reviewing system logs you can detect events that have occured.The following answers are incorrect:avoidance. This is incorrect, avoidance is a distractor. By reviewing system logs you have not avoided anything.deterrence. This is incorrect because system logs are a history of past events. You cannot deter something that has already occurred.prevention. This is incorrect because system logs are a history of past events. You cannot prevent something that has already occurred.
Which of the following would assist the most in Host Based intrusion detection?
To assist in Intrusion Detection you would review audit logs for access violations.The following answers are incorrect:access control lists. This is incorrect because access control lists determine who has access to what but do not detect intrusions.security clearances. This is incorrect because security clearances determine who has access to what but do not detect intrusions.host-based authentication. This is incorrect because host-based authentication determine who have been authenticated to the system but do not dectect intrusions.
Who should measure the effectiveness of Information System security related controls in an organization?
It is the systems auditor that should lead the effort to ensure that the security controls are in place and effective. The audit would verify that the controls comply with polices, procedures, laws, and regulations where applicable. The findings would provide these to senior management.The following answers are incorrect:the local security specialist. Is incorrect because an independent review should take place by a third party. The security specialist might offer mitigation strategies but it is the auditor that would ensure the effectiveness of the controlsthe business manager. Is incorrect because the business manager would be responsible that the controls are in place, but it is the auditor that would ensure the effectiveness of the controls.the central security manager. Is incorrect because the central security manager would be responsible for implementing the controls, but it is the auditor that is responsibe for ensuring their effectiveness.
Post your Comments and Discuss ISC SSCP exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SSCP content, but please register or login to continue.