CSSLP Exam Questions

Rob is the project manager of the IDLK Project for his company. This project has a budget of $5,600,000 and is expected to last 18 months. Rob has learned that a new law may affect...

Mark is the project manager of the NHQ project in StarTech Inc. The project has an asset valued at $195,000 and is subjected to an exposure factor of 35 percent. What will be the S...

FIPS 199 defines the three levels of potential impact on organizations: low, moderate, and high. Which of the following are the effects of loss of confidentiality, integrity, or av...

John works as a professional Ethical Hacker. He has been assigned the project of testing the attacks. As a countermeasure, he suggests that the Network Administrator should remove...

Penetration tests are sometimes called white hat attacks because in a pen test, the good guys are attempting to break in. What are the different categories of penetration testing?...

Shoulder surfing is a type of in-person attack in which the attacker gathers information about the premises of an organization. This attack is often performed by looking surreptiti...

Which of the following statements reflect the 'Code of Ethics Canons' in the '(ISC)2 Code of Ethics'? Each correct answer represents a complete solution. Choose all that apply.

The Systems Development Life Cycle (SDLC) is the process of creating or altering the systems; and the models and methodologies that people use to develop these systems. Which of th...

The service-oriented modeling framework (SOMF) introduces five major life cycle modeling activities that drive a service evolution during design-time and run-time. Which of the fol...

Which of the following concepts represent the three fundamental principles of information security? Each correct answer represents a complete solution. Choose three.

Samantha works as an Ethical Hacker for we-are-secure Inc. She wants to test the security of the we- are-secure server for DoS attacks. She sends large number of ICMP ECHO packets...

The DARPA paper defines various procedural patterns to perform secure system development practices. Which of the following patterns does it include? Each correct answer represents...

In which of the following SDLC phases is the system's security features configured and enabled, the system is tested and installed or fielded, and the system is authorized for proc...

John works as a systems engineer for BlueWell Inc. He has modified the software, and wants to retest the application to ensure that bugs have been fixed or not. Which of the follow...

Which of the following test methods has the objective to test the IT system from the viewpoint of a threat-source and to identify potential failures in the IT system protection sch...

Which of the following documents is defined as a source document, which is most useful for the ISSE when classifying the needed security functionality?

You work as the Senior Project manager in Dotcoiss Inc. Your company has started a software project using configuration management and has completed 70% of it. You need to ensure t...

FITSAF stands for Federal Information Technology Security Assessment Framework. It is a methodology for assessing the security of information systems. Which of the following FITSAF...

Which of the following ISO standards is entitled as "Information technology - Security techniques - Information security management - Measurement"?

Which of the following processes will you involve to perform the active analysis of the system for any potential vulnerabilities that may result from poor or improper system config...

Which of the following are the responsibilities of the owner with regard to data in an information classification program? Each correct answer represents a complete solution. Choos...

You are the project manager for a construction project. The project involves casting of a column in a very narrow space. Because of lack of space, casting it is highly dangerous. H...

Which of the following models manages the software development process if the developers are limited to go back only one stage to rework?

Mark works as a Network Administrator for NetTech Inc. He wants users to access only those resources that are required for them. Which of the following access control models will h...

Which of the following is a chronological record of system activities to enable the reconstruction and examination of the sequence of events and/or changes in an event?

Which of the following DITSCAP phases validates that the preceding work has produced an IS that operates in a specified computing environment?

How can you calculate the Annualized Loss Expectancy (ALE) that may occur due to a threat?

Which of the following terms refers to a mechanism which proves that the sender really sent a particular message?

In which of the following levels of exception safety are operations succeeded with full guarantee and fulfill all needs in the presence of exceptional situations?

Which of the following DoD policies establishes policies and assigns responsibilities to achieve DoD IA through a defense-in-depth approach that integrates the capabilities of pers...

Single Loss Expectancy (SLE) represents an organization's loss from a single threat. Which of the following formulas best describes the Single Loss Expectancy (SLE)?

Which of the following is a patch management utility that scans one or more computers on a network and alerts a user if any important Microsoft security patches are missing and als...

Which of the following plans is documented and organized for emergency response, backup operations, and recovery maintained by an activity as part of its security program that will...

An assistant from the HR Department calls you to ask the Service Hours & Maintenance Slots for your ERP system. In which document will you most probably find this information?

Which of the following are the basic characteristics of declarative security? Each correct answer represents a complete solution. Choose all that apply.

"Enhancing the Development Life Cycle to Produce Secure Software" summarizes the tools and practices that are helpful in producing secure software. What are these tools and practic...

In 2003, NIST developed a new Certification & Accreditation (C&A) guideline known as FIPS 199. What levels of potential impact are defined by FIPS 199? Each correct answer represen...

Which of the following NIST documents provides a guideline for identifying an information system as a National Security System?

John works as a professional Ethical Hacker. He has been assigned the project of testing the pre-attack phase to check the security of the We-are-secure network: Gathering informat...

An authentication method uses smart cards as well as usernames and passwords for authentication. Which of the following authentication methods is being referred to?

You work as a security engineer for BlueWell Inc. You want to use some techniques and procedures to verify the effectiveness of security controls in Federal Information System. Whi...

An organization monitors the hard disks of its employees' computers from time to time. Which policy does this pertain to?

You work as a CSO (Chief Security Officer) for Tech Perfect Inc. You want to perform the following tasks: Develop a risk-driven enterprise information security architecture. Delive...

In which of the following IDS evasion attacks does an attacker send a data packet such that IDS accepts the data packet but the host computer rejects it?

A security policy is an overall general statement produced by senior management that dictates what role security plays within the organization. What are the different types of poli...

Which of the following are the types of intellectual property? Each correct answer represents a complete solution. Choose all that apply.

In which of the following phases of the SDLC does the software and other components of the system faithfully incorporate the design specifications and provide proper documentation...

Security controls are safeguards or countermeasures to avoid, counteract, or minimize security risks. Which of the following are types of security controls? Each correct answer rep...

You work as a Security Manager for Tech Perfect Inc. You find that some applications have failed to encrypt network traffic while ensuring secure communications in the organization...

The rights of an author or a corporation to make profit from the creation of their products (such as software, music, etc.) are protected by the Intellectual Property law. Which of...