Instant Access ISC.CISSP.v2022-03-15.q465 Actual Practice Test Engine for Free (Page 85)

Welcome to DumpsDB

- Passing Exams, Dumps for Free

Request Exam Contact

Home
Popular Exams
- Oracle
- Fortinet
- Juniper
- Microsoft
- Cisco
- Citrix
- CompTIA
- VMware
- ISC
- SAP
- EMC
- PMI
- HP
- Salesforce
View All Exams
New Dumps
Upload

Oracle
Fortinet
Juniper
Microsoft
Cisco
Citrix
CompTIA
VMware
ISC
SAP
EMC
PMI
HP
Salesforce

Home
ISC Certification
CISSP Exam
ISC.CISSP.v2022-03-15.q465 Dumps

««
«
…
80
81
82
83
84
85
86
87
88
89
…
»
»»

Question 416

Which of the following would constitute the best example of a password to use for access to a system by a network administrator?

A.holiday
B.Christmas12
C.Jenny
D.GyN19Za!

Correct Answer: D

GyN19Za! would be the best answer because it contains a mixture of upper and lower case characters, alphabetic and numeric characters, and a special character making it less vulnerable to password attacks.
All of the other answers are incorrect because they are vulnerable to brute force or dictionary attacks. Passwords should not be common words or names. The addition of a number to the end of a common word only marginally strengthens it because a common password attack would also check combinations of words:
Christmas23
Christmas123 etc...

Comment: *

Name: *

Email: *

Verification: *

insert code

Question 417

Why do some sites choose not to implement Trivial File Transfer Protocol (TFTP)?

A.user authentication requirement
B.inherent security risks
C.list restrictions
D.directory restriction

Correct Answer: B

Comment: *

Name: *

Email: *

Verification: *

insert code

Question 418

Which of the following is related to physical security and is NOT considered a technical control?

A.Access control Mechanisms
B.Intrusion Detection Systems
C.Firewalls
D.Locks

Correct Answer: D

Explanation/Reference:
Explanation:
Locks are an example of a physical control type, not a technical control.
Controls are put into place to reduce the risk an organization faces, and they come in three main flavors:
administrative, technical, and physical. Administrative controls are commonly referred to as "soft controls" because they are more management-oriented. Examples of administrative controls are security documentation, risk management, personnel security, and training. Technical controls (also called logical controls) are software or hardware components, as in firewalls, IDS, encryption, identification and authentication mechanisms. And physical controls are items put into place to protect facility, personnel, and resources. Examples of physical controls are security guards, locks, fencing, and lighting.
Incorrect Answers:
A: Access control Mechanisms are an example of a technical control. Therefore, this answer is incorrect.
B: Intrusion Detection Systems are an example of a technical control. Therefore, this answer is incorrect.
C: Firewalls are an example of a technical control. Therefore, this answer is incorrect.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 28

Comment: *

Name: *

Email: *

Verification: *

insert code

Question 419

Which of the following is less likely to be included in the change control sub-phase of the maintenance phase of a software product?

A.Estimating the cost of the changes requested
B.Recreating and analyzing the problem
C.Determining the interface that is presented to the user
D.Establishing the priorities of requests

Correct Answer: C

Explanation/Reference:
Explanation:
To determine the user interface would not be part of the change control phase. This would be done in an earlier phase.
The change control analyst is responsible for approving or rejecting requests to make changes to the network, systems, or software. This role must make certain that the change will not introduce any vulnerability, that it has been properly tested, and that it is properly rolled out. The change control analyst needs to understand how various changes can affect security, interoperability, performance, and productivity.
Incorrect Answers:
A: Calculation the cost of the change should be a part of analyzing a change request.
B: Testing is a part of change control. If a problem occurs during testing change control should recreate and analyze the problem.
D: If there are multiple change requests then they must be prioritized in the change control phase.
References:
Conrad, Eric, Seth Misenar and Joshua Feldman, CISSP Study Guide, 2nd Edition, Syngress, Waltham,
2012, p. 1122

Comment: *

Name: *

Email: *

Verification: *

insert code

Question 420

Which of the following answers best describes the type of penetration testing where the analyst has full knowledge of the network on which he is going to perform his test?

A.White-Box Penetration Testing
B.Black-Box Pen Testing
C.Penetration Testing
D.Gray-Box Pen Testing

Correct Answer: A

In general there are three ways a pen tester can test a target system.
-White-Box: The tester has full access and is testing from inside the system.
-Gray-Box: The tester has some knowledge of the system he's testing.
-Black-Box: The tester has no knowledge of the system.
Each of these forms of testing has different benefits and can test different aspects of the system from different approaches.
The following answers are incorrect:
-Black-Box Pen Testing: This is where no prior knowledge is given about the target network. Only a domain name or business name may be given to the analyst.
-Penetration Testing: This is half correct but more specifically it is white-box testing because the tester has full access.
-Gray-Box Pen Testing: This answer is not right because Gray-Box testing you are given a little information about the target network.
The following reference(s) was used to create this question: 2013. Official Security+ Curriculum. and tester is provided no information about the target's network or environment. The tester is simply left to his abilities Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press) (Kindle Locations 4742-4743). Auerbach Publications. Kindle Edition.

Comment: *

Name: *

Email: *

Verification: *

insert code

««
«
…
80
81
82
83
84
85
86
87
88
89
…
»
»»

[×]

Download PDF File

Enter your email address to download ISC.CISSP.v2022-03-15.q465 Dumps

Email:

We are the Largest and the most Updated website for all vendors Certification Exam materials around the world.

Using resources of we provide, we strive using dumps to strengthen the community of High level Certification professionals for free.

DMCA
About
Contact Us
Privacy Policy
Terms & Conditions

©2026 DumpsDB

www.dumpsdb.com materials do not contain actual questions and answers from Cisco's certification exams.

Web Analytics