CSSLP Practice Questions

Qualitative ranks the probability and impact and then helps the project manager and team to

determine which risks need further analysis.

Perform Qualitative Risk Analysis is the process of prioritizing risks for further analysis and action. It

combines risks and their probability of

occurrences and ranks them accordingly. It enables organizations to improve the project's

performance by focusing on high-priority risks.

Perform Qualitative Risk Analysis is usually a rapid and cost-effective means of establishing priorities

for Plan Risk Responses. It also lays the

foundation for Perform Quantitative Risk Analysis.

Answer A is incorrect. Risk identification precedes this activity.

Answer B is incorrect. This process does not describe the decomposition and organization of risks

that you will complete in a risk

breakdown structure.

Answer D is incorrect. Quantitative analysis is the final step of risk analysis. Note the question tells

you that Fred and the team will

identify risks for additional analysis.

The various types of internal tests performed on builds are as follows:

Regression tests: It is also known as the verification testing. These tests are developed to confirm

that capabilities in earlier builds

continue to work correctly in the subsequent builds.

Functional test: These tests emphasizes on verifying that the build meets its functional and data

requirements and correctly generates

each expected display and report.

Performance tests: These tests are used to identify the performance thresholds of each build.

Reliability tests: These tests are used to identify the reliability thresholds of each build.

The annualized loss expectancy will be $360,000.

Annualized loss expectancy (ALE) is the annually expected financial loss to an organization from a

threat. The annualized loss expectancy

(ALE) is the product of the annual rate of occurrence (ARO) and the single loss expectancy (SLE). It is

mathematically expressed as follows:

ALE = Single Loss Expectancy (SLE) * Annualized Rate of Occurrence (ARO)

Here, it is as follows:

SLE = Asset value * EF (Exposure factor)

= 600,000 * (30/100)

= 600,000 * 0.30

= 180,000

ALE = SLE * ARO

= 180,000 * 2

= 360,000

Answer C, B, and D are incorrect. These are not valid answers.

John will perform OS fingerprinting on the We-are-secure network. Fingerprinting is the easiest way

to detect the Operating System (OS) of a

remote system. OS detection is important because, after knowing the target system's OS, it becomes

easier to hack into the system. The

comparison of data packets that are sent by the target system is done by fingerprinting. The analysis

of data packets gives the attacker a hint

as to which operating system is being used by the remote system.

There are two types of fingerprinting techniques as follows:

1.Active fingerprinting

2.Passive fingerprinting

In active fingerprinting ICMP messages are sent to the target system and the response message of

the target system shows which OS is

being used by the remote system. In passive fingerprinting the number of hops reveals the OS of the

remote system.

Answer D and B are incorrect. John should perform OS fingerprinting first, after which it will be easy

to identify which services are

running on the network since there are many services that run only on a specific operating system.

After performing OS fingerprinting, John

should perform networking mapping.

Answer C is incorrect. This is a pre-attack phase, and only after gathering all relevant knowledge of a

network should John install a

backdoor.

When you are hiring a third party to own risk, it is known as transference risk response.

Transference is a strategy to mitigate negative risks or threats. In this strategy, consequences and the

ownership of a risk is transferred to a

third party. This strategy does not eliminate the risk but transfers responsibility of managing the risk

to another party. Insurance is an

example of transference.

Answer B is incorrect. The act of spending money to reduce a risk probability and impact is known as

mitigation.

Answer A is incorrect. Exploit is a strategy that may be selected for risks with positive impacts where

the organization wishes to ensure

that the opportunity is realized.

Answer D is incorrect. When extra activities are introduced into the project to avoid the risk, this is

an example of avoidance.

The first action of a management program to implement information security is to have a security

program in place. The objectives of a security

program are as follows:

Protect the company and its assets

Manage risks by identifying assets, discovering threats, and estimating the risk

Provide direction for security activities by framing of information security policies, procedures,

standards, guidelines and baselines

Information classification

Security organization

Security education

Answer C is incorrect. System classification is not one of the objectives of a security program.

Port scanning identifies open doors to a computer. Hackers and crackers use this technique to obtain

unauthorized information.

Port scanning is the first basic step to get the details of open ports on the target system. Port

scanning is used to find a hackable server with

a hole or vulnerability. A port is a medium of communication between two computers. Every service

on a host is identified by a unique 16-bit

number called a port.

A port scanner is a piece of software designed to search a network host for open ports. This is often

used by administrators to check the

security of their networks and by hackers to identify running services on a host with the view to

compromising it. Port scanning is used to find

the open ports, so that it is possible to search exploits related to that service and application.

Answer D is incorrect. Phreaking is a process used to crack the phone system. The main aim of

phreaking is to avoid paying for long-

distance calls. As telephone networks have become computerized, phreaking has become closely

linked with computer hacking. This is

sometimes called the H/P culture (with H standing for Hacking and P standing for Phreaking).

Answer A is incorrect. It is defined as a system using a physical attribute for authenticating. Only

authorized users are provided access

to network or application.

Answer B is incorrect. It is described as a form of eavesdropping in which special equipments are

used to pick up the telecommunication

signals or data within a computer device.

The demon dialing technique automatically tests every phone line in an exchange and tries to locate

modems that are attached to the

network. Information about these modems can then be used to attempt external unauthorized

access.

Answer B is incorrect. In sniffing, a protocol analyzer is used to capture data packets that are later

decoded to collect information such

as passwords or infrastructure configurations.

Answer D is incorrect. Dumpster diving technique is used for searching paper disposal areas for

unshredded or otherwise improperly

disposed-of reports.

Answer C is incorrect. Social engineering is the most commonly used technique of all, getting

information (like passwords) just by

asking for them.

Configuration item cost is not a valid activity for configuration management. Cost changes are

managed by the cost change control system;

configuration management is concerned with changes to the features and functions of the project

deliverables.

The features of SIEM products are as follows:

Graphical user interface (GUI): It is used in analysis for identifying potential problems and reviewing

all available data that are

associated with the problems.

Security knowledge base: It includes information on known vulnerabilities, log messages, and other

technical data.

Incident tracking and hacking: It has robust workflow features to track and report incidents.

Asset information storage and correlation: It gives higher priority to an attack that affects a

vulnerable OS or a main host.

Answer B is incorrect. SIEM product does not have this feature.