CISSP Fragen Antworten, CISSP Online Tests

nuxibe

posted on 3 years ago — updated on 1 second ago

110
views

CISSP Fragen Antworten,CISSP Online Tests,CISSP Echte Fragen,CISSP Prüfungs,CISSP Deutsch Prüfungsfragen, CISSP Fragen Antworten, CISSP Online Tests

Laden Sie die neuesten It-Pruefung CISSP PDF-Versionen von Prüfungsfragen kostenlos von Google Drive herunter: https://drive.google.com/open?id=1_znCg4_DCVdi-1XboutzPv6QO94mH-SY

Die Examfragen zur ISC CISSP Zertifizierungsprüfung von It-Pruefung ist von den IT-Experten verifiziert und überprüft. Die Fragen und Antworten zur ISC CISSP Zertifizierungsprüfung sind die von der Praxis überprüfte Software und die Schulungsinstrumente. In It-Pruefung werden Sie die besten Zertifizierungsmaterialien finden, die originale Fragen und Antworten enthalten. Unsere Materialien bieten Ihnen die Chance, die echten Übungen zu machen. Endlich werden Sie Ihr Ziel, nämlich die ISC CISSP Zertifizierungsprüfung zu bestehen, erreichen.

Die ISC CISSP (Certified Information Systems Security Professional) Prüfung ist eine weltweit anerkannte Zertifizierungsprüfung, die dazu dient, die Expertise und das Wissen von Fachleuten im Bereich Informationssicherheit zu validieren. Diese Prüfung gilt als Maßstab für die Beurteilung der Kompetenz von Personen, die für die Gestaltung, Implementierung und Verwaltung von Sicherheitsprogrammen zur Abwehr potenzieller Cyber-Bedrohungen verantwortlich sind. Die CISSP-Zertifizierung ist in der Branche sehr angesehen und wird von vielen Organisationen weltweit anerkannt.

>> CISSP Fragen Antworten <<

CISSP Online Tests, CISSP Echte Fragen

Die von It-Pruefung gebotenen Prüfungsfragen enthalten wertvolle Prüfungserfahrungen und relevante Prüfungsmaterialien von IT-Experten uud auch die Prüfungsfragen und Antworten fürISC CISSP Zertifizierungsprüfung. Mit unserem guten Ruf in der IT-Branche geben wir Ihnen 100% Garantie. Sie können versuchsweise die Examensübungen-und antworten für die ISC CISSP Zertifizierungsprüfung teilweise als Probe umsonst herunterladen. Dann können Sie ganz beruhigt unsere Schulungsunterlagen kaufen.

Die CISSP-Zertifizierung ist ideal für Personen, die über mindestens fünf Jahre Berufserfahrung im Bereich Informationssicherheit verfügen. Das Zertifizierungsprogramm soll Fachleuten helfen, ein umfassendes Verständnis der Grundsätze der Informationssicherheit zu entwickeln und sie mit dem Wissen und den Fähigkeiten auszustatten, die sie zu effektiven Führungskräften auf diesem Gebiet machen. Die Zertifizierung demonstriert auch das Engagement eines Professionals für kontinuierliches Lernen und berufliche Weiterentwicklung und wird von Arbeitgebern auf der ganzen Welt sehr geschätzt. Angesichts des wachsenden Bedarfs an Informationssicherheitsfachleuten in der heutigen digitalen Landschaft ist die ISC CISSP-Zertifizierung ein wertvolles Asset für jeden, der seine Karriere im Bereich Informationssicherheit vorantreiben möchte.

ISC Certified Information Systems Security Professional CISSP Prüfungsfragen mit Lösungen (Q710-Q715):

710. Frage
What is the most critical characteristic of a biometric identifying system?

A. Perceived intrusiveness
B. Accuracy
C. Storage requirements
D. Scalability

Antwort: B

Begründung:
Accuracy is the most critical characteristic of a biometric identifying verification system.
Accuracy is measured in terms of false rejection rate (FRR, or type I errors) and false acceptance rate (FAR or type II errors).
The Crossover Error Rate (CER) is the point at which the FRR equals the FAR and has become the most important measure of biometric system accuracy.
Source: TIPTON, Harold F. & KRAUSE, Micki, Information Security Management
Handbook, 4th edition (volume 1), 2000, CRC Press, Chapter 1, Biometric Identification
(page 9).

711. Frage
Suppose that you are the COMSEC - Communications Security custodian for a large, multinational corporation. Susie, from Finance approaches you in the break room saying that she lost her smart ID Card that she uses to digitally sign and encrypt emails in the PKI.
What happens to the certificates contained on the smart card after the security officer takes appropriate action?

A. They are added to the CRL
B. New certificates are issued to the user
C. The user may no longer have certificates
D. They are reissued to the user

Antwort: A

Begründung:
Smart ID Cards can contain digital certifications user for establishing identity and for digitally encrypting and decrypting messages.
Commonly, there are three types of certificates on an ID Card: Identity certificate, private certificate and public certificate:
-Identity Certificate: This is the cert used to guarantee your identity, as when you swipe to enter a facility or when logging onto a computer
-Public Certificate: This is freely shared with the public. All who have it can use it to decrypt messages that you encrypt with your private key.
-Private Certificate: This is the key that you use to encrypt messages. It is a complimentary key to your public key. Only your public key can decrypt messages encrypted with the private key.
Otherwise known as PKI - Public Key Infrastructure, this is how the keys are used on your card.
Ordinarily, there is software on the computer that can, given the appropriate PIN number, log on,
digitally sign, encrypt and decrypt messages.
If you should lose your card the only certificate that is vital to be kept secret is your private key
because that can decrypt messages encrypt with your public key.
If this happens, the private key is added to the CRL - Certificate Revocation List. It is published by
the Certificate Authority or CA server and must periodically be downloaded so that the system
knows which certificates to trust and which not to trust.
Notably, revocation lists can become quite large and slow to download, especially over slower or
tactical military networks. Also, certificates can be in one of two states on the CRL: Revoked or
Hold. A hold can be reversed but once in revoked status, it is gone forever
ABOUT OCSP
Another way of validating if a certificate is valid is using OCSP.
The Online Certificate Status Protocol (OCSP) is an Internet protocol used for obtaining the revocation status of an X.509 digital certificate. It is described in RFC 6960 and is on the Internet standards track. It was created as an alternative to certificate revocation lists (CRL), specifically addressing certain problems associated with using CRLs in a public key infrastructure (PKI). Messages communicated via OCSP are encoded in ASN.1 and are usually communicated over HTTP. The "request/response" nature of these messages leads to OCSP servers being termed OCSP responders.
The following answers are incorrect:
-They are reissued to the user: This isn't correct because once a private certificate is lost, it may never again be trusted because it has been out of control of the user.
-New certificates are issued to the user: This is actually correct but not what happens first. Ordinarily the previous certificates for the users are added to the CRL and THEN the new certificates are issued to the user. This way there is no chance a double set of certs are out there for a single user.
-The user may no longer have certificates: This isn't correct, unless the user is fired or quits. Users must have certificates to operate in a PKI environment. (Public Key Infrastructure)
The following reference(s) was used to create this question: 2013. Official Security+ Curriculum.

712. Frage
Which of the following protocol is PRIMARILY used to provide confidentiality in a web based application thus protecting data sent across a client machine and a server?

A. S/MIME
B. SSL
C. FTP
D. SSH

Antwort: B

Begründung:
The Secure Socket Layer (SSL) Protocol is primarily used to provide confidentiality
to the information sent across clients and servers.
For your exam you should know the information below:
The Secure Sockets Layer (SSL) is a commonly-used protocol for managing the security of a
message transmitted over a public network such as the Internet.
SSL has recently been succeeded by Transport Layer Security (TLS), which is based on SSL.
SSL uses a program layer located between the Internet's Hypertext Transfer Protocol (HTTP) and
Transport Control Protocol (TCP) layers.
SSL is included as part of both the Microsoft and Netscape browsers and most Web server
products.
Developed by Netscape, SSL also gained the support of Microsoft and other Internet client/server
developers as well and became the de facto standard until evolving into Transport Layer Security.
The "sockets" part of the term refers to the sockets method of passing data back and forth
between a client and a server program in a network or between program layers in the same
computer. SSL uses the public-and-private key encryption system from RSA, which also includes
the use of a digital certificate. Later on SSL uses a Session Key along a Symmetric Cipher for the
bulk of the data.
TLS and SSL are an integral part of most Web browsers (clients) and Web servers. If a Web site is
on a server that supports SSL, SSL can be enabled and specific Web pages can be identified as
requiring SSL access. Any Web server can be enabled by using Netscape's SSLRef program
library which can be downloaded for noncommercial use or licensed for commercial use.
TLS and SSL are not interoperable. However, a message sent with TLS can be handled by a
client that handles SSL but not TLS.
The SSL handshake
A HTTP-based SSL connection is always initiated by the client using a URL starting with https://
instead of with http://. At the beginning of an SSL session, an SSL handshake is performed. This
handshake produces the cryptographic parameters of the session. A simplified overview of how
the SSL handshake is processed is shown in the diagram below.
SSL Handshake
Image Reference - http://publib.boulder.ibm.com/tividd/td/ITAME/SC32-1363-
00/en_US/HTML/handshak.gif
The client sends a client "hello" message that lists the cryptographic capabilities of the client
(sorted in client preference order), such as the version of SSL, the cipher suites supported by the
client, and the data compression methods supported by the client. The message also contains a
28-byte random number.
The server responds with a server "hello" message that contains the cryptographic method (cipher
suite) and the data compression method selected by the server, the session ID, and another
random number.
Note:
The client and the server must support at least one common cipher suite, or else the handshake
fails. The server generally chooses the strongest common cipher suite.
The server sends its digital certificate. (In this example, the server uses X.509 V3 digital
certificates with SSL.)
If the server uses SSL V3, and if the server application (for example, the Web server) requires a
digital certificate for client authentication, the server sends a "digital certificate request" message.
In the "digital certificate request" message, the server sends a list of the types of digital certificates
supported and the distinguished names of acceptable certificate authorities.
The server sends a server "hello done" message and waits for a client response. Upon receipt of
the server "hello done" message, the client (the Web browser) verifies the validity of the server's
digital certificate and checks that the server's "hello" parameters are acceptable.
If the server requested a client digital certificate, the client sends a digital certificate, or if no
suitable digital certificate is available, the client sends a "no digital certificate" alert. This alert is
only a warning, but the server application can fail the session if client authentication is mandatory.
The client sends a "client key exchange" message. This message contains the pre-master secret,
a 46-byte random number used in the generation of the symmetric encryption keys and the
message authentication code (MAC) keys, encrypted with the public key of the server.
If the client sent a digital certificate to the server, the client sends a "digital certificate verify"
message signed with the client's private key. By verifying the signature of this message, the server
can explicitly verify the ownership of the client digital certificate.
Note:
An additional process to verify the server digital certificate is not necessary. If the server does not
have the private key that belongs to the digital certificate, it cannot decrypt the pre-master secret
and create the correct keys for the symmetric encryption algorithm, and the handshake fails.
The client uses a series of cryptographic operations to convert the pre-master secret into a master
secret, from which all key material required for encryption and message authentication is derived.
Then the client sends a "change cipher spec" message to make the server switch to the newly
negotiated cipher suite. The next message sent by the client (the "finished" message) is the first
message encrypted with this cipher method and keys.
The server responds with a "change cipher spec" and a "finished" message of its own. The SSL handshake ends, and encrypted application data can be sent.
The following answers are incorrect: FTP - File Transfer Protocol (FTP) is a standard Internet protocol for transmitting files between computers on the Internet. Like the Hypertext Transfer Protocol (HTTP), which transfers displayable Web pages and related files, and the Simple Mail Transfer Protocol (SMTP), which transfers e-mail, FTP is an application protocol that uses the Internet's TCP/IP protocols. FTP is commonly used to transfer Web page files from their creator to the computer that acts as their server for everyone on the Internet. It's also commonly used to download programs and other files to your computer from other servers.
SSH - Secure Shell (SSH) is a cryptographic network protocol for secure data communication, remote command-line login, remote command execution, and other secure network services between two networked computers. It connects, via a secure channel over an insecure network, a server and a client running SSH server and SSH client programs, respectively.
S/MIME - S/MIME (Secure Multi-Purpose Internet Mail Extensions) is a secure method of sending e-mail that uses the Rivest-Shamir-Adleman encryption system. S/MIME is included in the latest versions of the Web browsers from Microsoft and Netscape and has also been endorsed by other vendors that make messaging products. RSA has proposed S/MIME as a standard to the Internet Engineering Task Force (IETF).
Following reference(s) were/was used to create this question: CISA review manual 2014 Page number 352 Official ISC2 guide to CISSP CBK 3rd Edition Page number 256 http://publib.boulder.ibm.com/tividd/td/ITAME/SC32-1363-00/en_US/HTML/ss7aumst18.htm
Topic 3, Information Security Governence and Risk Management

713. Frage
A packet containing a long string of NOP's followed by a command is usually indicative of what?

A. A packet destined for the network's broadcast address.
B. A syn scan.
C. A buffer overflow attack.
D. A half-port scan.

Antwort: C

Begründung:
A series of the same control, hexidecimal, characters imbedded in the string is
usually an indicator of a buffer overflow attack. A NOP is a instruction which does nothing (No
Operation - the hexadecimal equivalent is 0x90)
The following answers are incorrect:
A syn scan. This is incorrect because a SYN scan is when a SYN packet is sent to a specific port
and the results are then analyzed.
A half-port scan. This is incorrect because the port scanner generates a SYN packet. If the target
port is open, it will respond with a SYN-ACK packet. The scanner host responds with a RST
packet, closing the connection before the handshake is completed. Also known as a Half Open
Port scan.
A packet destined for the network's broadcast address. This is incorrect because this type of
packet would not contain a long string of NOP characters.

714. Frage
Which of the following types of business continuity tests includes assessment of resilience to internal and external risks without endangering live operations?

A. Parallel
B. Simulation
C. White box
D. Walkthrough

Antwort: B

Begründung:
Explanation/Reference:
Reference: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/ file/61029/Chapter-6-Business-Continuity-Management_amends_04042012.pdf

715. Frage
......

CISSP Online Tests: https://www.it-pruefung.com/CISSP.html

Laden Sie die neuesten It-Pruefung CISSP PDF-Versionen von Prüfungsfragen kostenlos von Google Drive herunter: https://drive.google.com/open?id=1_znCg4_DCVdi-1XboutzPv6QO94mH-SY