Instant Access ISC.CISSP.v2022-03-15.q465 Actual Practice Test Engine for Free (Page 57)

Question 276

Which of the following statements pertaining to ethical hacking is incorrect?

A.An organization should use ethical hackers who do not sell auditing, hardware, software, firewall, hosting, and/or networking services.
B.Testing should be done remotely to simulate external threats.
C.Ethical hacking should not involve writing to or modifying the target systems negatively.
D.Ethical hackers never use tools that have the potential of affecting servers or services.

Correct Answer: D

This means that many of the tools used for ethical hacking have the potential of exploiting vulnerabilities and causing disruption to IT system. It is up to the individuals performing the tests to be familiar with their use and to make sure that no such disruption can happen or at least shoudl be avoided.
The first step before sending even one single packet to the target would be to have a signed agreement with clear rules of engagement and a signed contract. The signed contract explains to the client the associated risks and the client must agree to them before you even send one packet to the target range. This way the client understand that some of the test could lead to interruption of service or even crash a server. The client signs that he is aware of such risks and willing to accept them.
The following are incorrect answers:
An organization should use ethical hackers who do not sell auditing, hardware, software, firewall, hosting, and/or networking services. An ethical hacking firm's independence can be questioned if they sell security solutions at the same time as doing testing for the same client. There has to be independance between the judge (the tester) and the accuse (the client).
Testing should be done remotely to simulate external threats Testing simulating a cracker from the Internet is often time one of the first test being done, this is to validate perimeter security. By performing tests remotely, the ethical hacking firm emulates the hacker's approach more realistically.
Ethical hacking should not involve writing to or modifying the target systems negatively.
Even though ethical hacking should not involve negligence in writing to or modifying the target systems or reducing its response time, comprehensive penetration testing has to be performed using the most complete tools available just like a real cracker would.
Reference(s) used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, John Wiley & Sons, 2001, Appendix F: The Case for
Ethical Hacking (page 520).

Question 277

Which of the following attack could be avoided by creating more security awareness in the organization and provide adequate security knowledge to all employees?

A.Smurf attack
B.Traffic analysis
C.Phishing
D.Interrupt attack

Question 278

Which one of the following is a key agreement protocol used to enable two entities to agree and generate a session key (secret key used for one session) over an insecure medium without any prior secrets or communications between the entities? The negotiated key will subsequently be used for message encryption using Symmetric Cryptography.

A.RSA
B.PKI
C.Diffie_Hellmann
D.3DES

Question 279

Which of the following Operation Security controls is intended to prevent unauthorized intruders from internally or externally accessing the system, and to lower the amount and impact of unintentional errors that are entering the system?

A.Detective Controls
B.Preventative Controls
C.Corrective Controls
D.Directive Controls

Question 280

*Directive controls are a form of change management policy and procedures. Which of the following subsections are recommended as part of the change management process?

A.Build and test
B.Implement security controls
C.Categorize Information System (IS)
D.Select security controls

Question 276

Question 277

Question 278

Question 279

Question 280

Download PDF File