그리고 Fast2test CISSP 시험 문제집의 전체 버전을 클라우드 저장소에서 다운로드할 수 있습니다: https://drive.google.com/open?id=18YEFfHHAOlvNYaBt_X3tdiB2rkpsXuh9
It 업계 중 많은 분들이 인증시험에 관심이 많은 인사들이 많습니다.it산업 중 더 큰 발전을 위하여 많은 분들이ISC CISSP를 선택하였습니다.인증시험은 패스를 하여야 자격증취득이 가능합니다.그리고 무엇보다도 통행증을 받을 수 잇습니다.ISC CISSP은 그만큼 아주 어려운 시험입니다. 그래도ISC CISSP인증을 신청하여야 좋은 선택입니다.우리는 매일매일 자신을 업그레이드 하여야만 이 경쟁이 치열한 사회에서 살아남을 수 있기 때문입니다.
| Section | Weight | Objectives |
|---|---|---|
| Security Operations | 13% | - Implement disaster recovery processes
|
| Identity and Access Management | 13% | - Manage identification and authentication
|
| Software Development Security | 11% | - Assess software security effectiveness
|
| Security and Risk Management | 15% | - Establish and manage security awareness training
|
| Security Assessment and Testing | 12% | - Design and validate assessment strategies
|
| Communication and Network Security | 13% | - Secure network components
|
| Security Architecture and Engineering | 13% | - Select controls based on security requirements
|
| Asset Security | 10% | - Provision resources securely
|
성공으로 향하는 길에는 많은 방법과 방식이 있습니다. ISC인증 CISSP시험을 패스하는 길에는Fast2test의ISC인증 CISSP덤프가 있습니다. Fast2test의ISC인증 CISSP덤프는 실제시험 출제방향에 초점을 두어 연구제작한 시험준비공부자료로서 높은 시험적중율과 시험패스율을 자랑합니다.국제적으로 승인해주는 IT자격증을 취득하시면 취직 혹은 승진이 쉬워집니다.
질문 # 813
A financial services organization has employed a security consultant to review processes used by employees across various teams. The consultant interviewed a member of the application development practice and found gaps in their threat model. Which of the following correctly represents a trigger for when a threat model should be revised?
정답：C
설명：
A threat model is a structured representation of the potential threats and vulnerabilities that may affect an application or system. A threat model should be revised whenever there is a significant change in the design, architecture, functionality, or environment of the application or system that may introduce new threats or vulnerabilities or alter the existing ones. A new data repository is an example of such a change, as it may affect the confidentiality, integrity, or availability of the data stored or processed by the application or system.
Therefore, a new data repository is a trigger for when a threat model should be revised. The other options are not triggers for revising a threat model, as they do not affect the application or system directly or significantly.
References: Official (ISC)2 CISSP CBK Reference, Fifth Edition, Domain 8: Software Development Security, pp. 1383-1384; CISSP All-in-One Exam Guide, Eighth Edition, Chapter 21: Software Development Security, pp. 2017-2018.
질문 # 814
Which of the following is not a one-way hashing algorithm?
정답：A
설명：
RC4 was designed by Ron Rivest of RSA Security in 1987. While it is officially termed "Rivest Cipher 4", the RC acronym is alternatively understood to stand for
"Ron's Code" (see also RC2, RC5 and RC6).
RC4 was initially a trade secret, but in September 1994 a description of it was anonymously posted to the Cypherpunks mailing list. It was soon posted on the sci.crypt newsgroup, and from there to many sites on the Internet. The leaked code was confirmed to be genuine as its output was found to match that of proprietary software using licensed
RC4. Because the algorithm is known, it is no longer a trade secret. The name RC4 is trademarked, so RC4 is often referred to as ARCFOUR or ARC4 (meaning alleged RC4) to avoid trademark problems. RSA Security has never officially released the algorithm; Rivest has, however, linked to the English Wikipedia article on RC4 in his own course notes. RC4 has become part of some commonly used encryption protocols and standards, including
WEP and WPA for wireless cards and TLS.
The main factors in RC4's success over such a wide range of applications are its speed and simplicity: efficient implementations in both software and hardware are very easy to develop.
The following answer were not correct choices:
SHA-1 is a one-way hashing algorithms. SHA-1 is a cryptographic hash function designed by the United States National Security Agency and published by the United States NIST as a U.S. Federal Information Processing Standard. SHA stands for "secure hash algorithm".
The three SHA algorithms are structured differently and are distinguished as SHA-0, SHA-
1, and SHA-2. SHA-1 is very similar to SHA-0, but corrects an error in the original SHA hash specification that led to significant weaknesses. The SHA-0 algorithm was not adopted by many applications. SHA-2 on the other hand significantly differs from the SHA-
1 hash function.
SHA-1 is the most widely used of the existing SHA hash functions, and is employed in several widely used security applications and protocols. In 2005, security flaws were identified in SHA-1, namely that a mathematical weakness might exist, indicating that a stronger hash function would be desirable. Although no successful attacks have yet been reported on the SHA-2 variants, they are algorithmically similar to SHA-1 and so efforts are underway to develop improved alternatives. A new hash standard, SHA-3, is currently under development - an ongoing NIST hash function competition is scheduled to end with the selection of a winning function in 2012.
SHA-1 produces a 160-bit message digest based on principles similar to those used by
Ronald L. Rivest of MIT in the design of the MD4 and MD5 message digest algorithms, but has a more conservative design.
MD2 is a one-way hashing algorithms. The MD2 Message-Digest Algorithm is a cryptographic hash function developed by Ronald Rivest in 1989. The algorithm is optimized for 8-bit computers. MD2 is specified in RFC 1319. Although MD2 is no longer considered secure, even as of 2010 it remains in use in public key infrastructures as part of certificates generated with MD2 and RSA.
Haval is a one-way hashing algorithms. HAVAL is a cryptographic hash function. Unlike
MD5, but like most modern cryptographic hash functions, HAVAL can produce hashes of different lengths. HAVAL can produce hashes in lengths of 128 bits, 160 bits, 192 bits, 224 bits, and 256 bits. HAVAL also allows users to specify the number of rounds (3, 4, or 5) to be used to generate the hash.
The following reference(s) were used for this question:
SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000.
and
https://en.wikipedia.org/wiki/HAVAL
and
https://en.wikipedia.org/wiki/MD2_%28cryptography%29
and
https://en.wikipedia.org/wiki/SHA-1
질문 # 815
Which of the following technologies is a target of XSS or CSS (Cross-Site Scripting) attacks?
정답：A
설명：
Explanation/Reference:
Explanation:
Cross-site scripting (XSS) is a form of malicious code-injection attack on a web server in which an attacker injects code into the content sent to website visitors. XSS can be mitigated by implementing patch management on the web server, using firewalls, and auditing for suspicious activity.
Incorrect Answers:
B: Cross-site scripting (XSS) attacks target websites and web applications. It does not target Intrusion Detection Systems (IDS).
C: Cross-site scripting (XSS) attacks target websites and web applications. It does not target firewalls.
B: Cross-site scripting (XSS) attacks target websites and web applications. It does not target DNS Servers.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 1164, 1168
https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
질문 # 816
Which one of the following is a common risk with network configuration management?
정답：A
설명：
A common risk with network configuration management is that network diagrams are not up to date. Network configuration management is a process or a technique that monitors, controls, and maintains the configuration or the settings of the network devices or the components within a system or a service, such as the routers, the switches, or the firewalls, to ensure or maintain the performance, the functionality, or the security of the system or the service. Network diagrams are graphical representations or visualizations of the network devices or the components within a system or a service, and their connections or relationships, such as the topology, the layout, or the architecture, that are used or applied for the network configuration management process or technique, to understand, to document, or to communicate the configuration or the settings of the network devices or the components within a system or a service, such as the routers, the switches, or the firewalls. A common risk with network configuration management is that network diagrams are not up to date, which means that the network diagrams do not reflect or represent the current or the accurate configuration or the settings of the network devices or the components within a system or a service, such as the routers, the switches, or the firewalls, due to the changes or the modifications that occur or happen in the system or the service, such as the addition, the removal, or the update of the network devices or the components within a system or a service, and due to the lack or the absence of the update or the maintenance of the network diagrams. Network diagrams that are not up to date can pose or present a risk or a challenge to the network configuration management process or technique, as they can cause or result in the confusion, the inconsistency, or the error in the monitoring, the control, or the maintenance of the configuration or the settings of the network devices or the components within a system or a service, such as the routers, the switches, or the firewalls, and as they can also affect or impact the performance, the functionality, or the security of the system or the service.
질문 # 817
Which one of the following represents an ALE calculation?
정답：D
설명：
Explanation/Reference:
Explanation:
The Annualized Loss Expectancy (ALE) is the monetary loss that can be expected for an asset due to a risk over a one year period. It is defined as:
ALE = SLE * ARO
where SLE is the Single Loss Expectancy and ARO is the Annualized Rate of Occurrence.
Single loss expectancy is one instance of an expected loss if a specific vulnerability is exploited and how it affects a single asset. Asset Value × Exposure Factor = SLE.
The annualized rate of occurrence (ARO) is the value that represents the estimated frequency of a specific threat taking place within a 12-month timeframe.
Incorrect Answers:
B: Gross loss expectancy and loss frequency are not terms used for calculations in Quantitative Risk Analysis.
C: Actual replacement cost and proceeds of salvage are not terms used for calculations in Quantitative Risk Analysis.
D: Asset value x loss expectancy is not the correct formula to calculate the Annualized Loss Expectancy (ALE).
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 87
질문 # 818
......
ISC CISSP인증덤프는 실제 CISSP시험의 가장 최근 시험의 기출문제를 기준으로 하여 만들어진 최고품질을 자랑하는 최고적중율의 시험대비자료입니다. 저희 CISSP덤프로 CISSP시험에 도전해보지 않으실래요? CISSP시험에서 불합격 받을시 덤프비용은 환불해드리기에 부담없이 구매하셔도 됩니다.환불의 유일한 기준은 불합격 성적표이고 환불유효기간은 구매일로부터 60일까지입니다.
CISSP인기자격증 시험 덤프자료: https://kr.fast2test.com/CISSP-premium-file.html
참고: Fast2test에서 Google Drive로 공유하는 무료, 최신 CISSP 시험 문제집이 있습니다: https://drive.google.com/open?id=18YEFfHHAOlvNYaBt_X3tdiB2rkpsXuh9