CSSLP Exam Questions

Certification and Accreditation (C&A or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing s...

The Phase 1 of DITSCAP C&A is known as Definition Phase. The goal of this phase is to define the C&A level of effort, identify the main C&A roles and responsibilities, and create a...

Which of the following NIST Special Publication documents provides a guideline on network security testing?

Which of the following tools is used to attack the Digital Watermarking?

You and your project team have identified the project risks and now are analyzing the probability and impact of the risks. What type of analysis of the risks provides a quick and h...

What component of the change management system is responsible for evaluating, testing, and documenting changes created to the project scope?

You work as a project manager for BlueWell Inc. You with your team are using a method or a (technical) process that conceives the risks even if all theoretically possible safety me...

You are the project manager of the NNN project for your company. You and the project team are working together to plan the risk responses for the project. You feel that the team ha...

Which of the following statements is true about residual risks?

To help review or design security controls, they can be classified by several criteria . One of these criteria is based on their nature. According to this criterion, which of the f...

A Web-based credit card company had collected financial and personal details of Mark before issuing him a credit card. The company has now provided Mark's financial and personal de...

There are seven risks responses that a project manager can choose from. Which risk response is appropriate for both positive and negative risk events?

You work as a Security Manager for Tech Perfect Inc. In the organization, Syslog is used for computer system management and security auditing, as well as for generalized informatio...

You work as a project manager for a company. The company has started a new security software project. The software configuration management will be used throughout the lifecycle of...

Which of the following areas of information system, as separated by Information Assurance Framework, is a collection of local computing devices, regardless of physical location, th...

Which of the following is a signature-based intrusion detection system (IDS) ?

Which of the following statements about the availability concept of Information security management is true?

A security policy is an overall general statement produced by senior management that dictates what role security plays within the organization. Which of the following are required...

The Phase 4 of DITSCAP C&A is known as Post Accreditation. This phase starts after the system has been accredited in Phase 3. What are the process activities of this phase? Each co...

You work as a security engineer for BlueWell Inc. Which of the following documents will you use as a guide for the security certification and accreditation of Federal Information S...

Which of the following is an example of over-the-air (OTA) provisioning in digital rights management?

The service-oriented modeling framework (SOMF) provides a common modeling notation to address alignment between business and IT organizations. Which of the following principles doe...

Which of the following DoD directives is referred to as the Defense Automation Resources Management Manual?

Which of the following access control models are used in the commercial sector? Each correct answer represents a complete solution. Choose two.

Which of the following testing methods verifies the interfaces between components against a software design?

Which of the following statements best describes the difference between the role of a data owner and the role of a data custodian?

Della works as a security engineer for BlueWell Inc. She wants to establish configuration management and control procedures that will document proposed or actual changes to the inf...

Which of the following secure coding principles and practices defines the appearance of code listing so that a code reviewer and maintainer who have not written that code can easil...

Which of the following software review processes increases the software security by removing the common vulnerabilities, such as format string exploits, race conditions, memory lea...

Which of the following governance bodies directs and coordinates implementations of the information security program?

In which of the following alternative processing sites is the backup facility maintained in a constant order, with a full complement of servers, workstations, and communication lin...

Which of the following methods offers a number of modeling practices and disciplines that contribute to a successful service-oriented life cycle management and modeling?

Which of the following phases of DITSCAP includes the activities that are necessary for the continuing operation of an accredited IT system in its computing environment and for add...

Joseph works as a Software Developer for WebTech Inc. He wants to protect the algorithms and the techniques of programming that he uses in developing an application. Which of the f...

Which of the following types of signatures is used in an Intrusion Detection System to trigger on attacks that attempt to reduce the level of a resource or system, or to cause it t...

Which of the following is a set of exclusive rights granted by a state to an inventor or his assignee for a fixed period of time in exchange for the disclosure of an invention?

Which of the following actions does the Data Loss Prevention (DLP) technology take when an agent detects a policy violation for data of all states? Each correct answer represents a...

In which of the following processes are experienced personnel and software tools used to investigate, resolve, and handle process deviation, malformed data, infrastructure, or conn...

Which of the following rated systems of the Orange book has mandatory protection of the TCB?

Which of the following is designed to detect unwanted attempts at accessing, manipulating, and disabling of computer systems through the Internet?

Which of the following ensures that a party to a dispute cannot deny the authenticity of their signature on a document or the sending of a message that they originated?

Which of the following are examples of the application programming interface (API)? Each correct answer represents a complete solution. Choose three.

In which of the following cryptographic attacking techniques does an attacker obtain encrypted messages that have been encrypted using the same encryption algorithm?

The IAM/CA makes certification accreditation recommendations to the DAA. The DAA issues accreditation determinations. Which of the following are the accreditation determinations is...

Which of the following strategies is used to minimize the effects of a disruptive event on a company, and is created to prevent interruptions to normal business activity?

Which of the following ISO standards provides guidelines for accreditation of an organization that is concerned with certification and registration related to ISMS?

You are advising a school district on disaster recovery plans. In case a disaster affects the main IT centers for the district they will need to be able to work from an alternate l...

Which of the following authentication methods is used to access public areas of a Web site?

Stella works as a system engineer for BlueWell Inc. She wants to identify the performance thresholds of each build. Which of the following tests will help Stella to achieve her tas...

Continuous Monitoring is the fourth phase of the security certification and accreditation process. What activities are performed in the Continuous Monitoring process? Each correct...