Instant Access ISC.CSSLP.v2022-08-12.q154 Actual Practice Test Engine for Free (Page 23)

40%off

CSSLP Premium Dumps

Latest CSSLP Exam Premium Dumps provide by TrainingQuiz.com to help you Passing CSSLP Exam! TrainingQuiz.com offers the updated CSSLP exam dumps, the TrainingQuiz.com CSSLP exam questions has been updated to correct Answer. Get the latest TrainingQuiz.com CSSLP pdf dumps with Exam Engine here:

(349 Q&As Dumps, 40%OFF Special Discount: DumpsDB)

Question 106

FITSAF stands for Federal Information Technology Security Assessment Framework. It is a methodology for assessing the security of information systems. Which of the following FITSAF levels shows that the procedures and controls are tested and reviewed?

A.Level 4
B.Level 5
C.Level 2
D.Level 3
E.Level 1

Question 107

Which of the following types of attacks occurs when an attacker successfully inserts an intermediary software or program between two communicating hosts?

A.Denial-of-service attack
B.Dictionary attack
C.Man-in-the-middle attack
D.Password guessing attack

Question 108

You work as the senior project manager in SoftTech Inc. You are working on a software project using configuration management. Through configuration management you are decomposing the verification system into identifiable, understandable, manageable, traceable units that are known as Configuration Items (CIs). According to you, which of the following processes is known as the decomposition process of a verification system into Configuration Items?

A.Configuration status accounting
B.Configuration identification
C.Configuration auditing
D.Configuration control

Correct Answer: B

Explanation/Reference:
Explanation: Configuration identification is known as the decomposition process of a verification system into Configuration Items. Configuration identification is the process of identifying the attributes that define every aspect of a configuration item. A configuration item is a product (hardware and/or software) that has an end-user purpose. These attributes are recorded in configuration documentation and baselined.
Baselining an attribute forces formal configuration change control processes to be effected in the event that these attributes are changed. Answer: D is incorrect. Configuration control is a procedure of the Configuration management. Configuration control is a set of processes and approval stages required to change a configuration item's attributes and to re-baseline them. It supports the change of the functional and physical attributes of software at various points in time, and performs systematic control of changes to the identified attributes. Configuration control is a means of ensuring that system changes are approved before being implemented. Only the proposed and approved changes are implemented, and the implementation is complete and accurate. Answer: A is incorrect. The configuration status accounting procedure is the ability to record and report on the configuration baselines associated with each configuration item at any moment of time. It supports the functional and physical attributes of software at various points in time, and performs systematic control of accounting to the identified attributes for the purpose of maintaining software integrity and traceability throughout the software development life cycle.
Answer C is incorrect. Configuration auditing is the quality assurance element of configuration
management. It is occupied in the process of periodic checks to establish the consistency and completeness of accounting information and to validate that all configuration management policies are being followed. Configuration audits are broken into functional and physical configuration audits. They occur either at delivery or at the moment of effecting the change. A functional configuration audit ensures that functional and performance attributes of a configuration item are achieved, while a physical configuration audit ensures that a configuration item is installed in accordance with the requirements of its detailed design documentation.

Question 109

In which of the following IDS evasion attacks does an attacker send a data packet such that IDS accepts the data packet but the host computer rejects it?

A.Evasion attack
B.Fragmentation overlap attack
C.Fragmentation overwrite attack
D.Insertion attack

Question 110

Which of the following security controls will you use for the deployment phase of the SDLC to build secure software? Each correct answer represents a complete solution. Choose all that apply.

A.Change and Configuration Control
B.Security Certification and Accreditation (C&A)
C.Vulnerability Assessment and Penetration Testing
D.Risk Adjustments