[2023年11月08日] 最新でリアルなCSSLP試験問題集解答 [Q92-Q112]

質問 92
You work as a Security Manager for Tech Perfect Inc. You want to save all the data from the SQL injection attack, which can read sensitive data from the database and modify database data using some commands, such as Insert, Update, and Delete. Which of the following tasks will you perform? Each correct answer represents a complete solution. Choose three.

Apply maximum number of database permissions.

Use an encapsulated library for accessing databases.

Create parameterized stored procedures.

Create parameterized queries by using bound and typed parameters.

質問 93
Which of the following are the types of access controls? Each correct answer represents a complete solution. Choose three.

Physical

Technical

Administrative

Automatic

質問 94
Mark works as a Network Administrator for NetTech Inc. He wants users to access only those resources that are required for them. Which of the following access control models will he use?

Discretionary Access Control

Mandatory Access Control

Policy Access Control

Role-Based Access Control

Explanation:
Role-based access control (RBAC) is an access control model. In this model, a user can access resources according to his role in the organization. For example, a backup administrator is responsible for taking backups of important data. Therefore, he is only authorized to access this data for backing it up. However, sometimes users with different roles need to access the same resources. This situation can also be handled using the RBAC model.

質問 95
Which of the following types of activities can be audited for security? Each correct answer represents a complete solution. Choose three.

File and object access

Data downloading from the Internet

Printer access

Network logons and logoffs

質問 96
Which of the following is an open source network intrusion detection system?

NETSH

Macof

Sourcefire

Snort

Explanation:
Snort is an open source network intrusion prevention and detection system that operates as a network sniffer. It logs activities of the network that is matched with the predefined signatures. Signatures can be designed for a wide range of traffic, including Internet Protocol (IP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Internet Control Message Protocol (ICMP). The three main modes in which Snort can be configured are as follows:
Sniffer mode: It reads the packets of the network and displays them in a continuous stream on the console. Packet logger mode: It logs the packets to the disk. Network intrusion detection mode: It is the most complex and configurable configuration, allowing Snort to analyze network traffic for matches against a user-defined rule set.

質問 97
You are the project manager of the GHY project for your organization. You are about to start the qualitative risk analysis process for the project and you need to determine the roles and responsibilities for conducting risk management. Where can you find this information?

Risk register

Staffing management plan

Risk management plan

Enterprise environmental factors

質問 98
Which of the following programming languages are compiled into machine code and directly executed by the CPU of a computer system? Each correct answer represents a complete solution. Choose two.

C

Microosft.NET

Java EE

C++

質問 99
NIST SP 800-53A defines three types of interview depending on the level of assessment conducted. Which of the following NIST SP 800-53A interviews consists of informal and ad hoc interviews?

Comprehensive

Significant

Abbreviated

Substantial

質問 100
The DARPA paper defines various procedural patterns to perform secure system development practices. Which of the following patterns does it include? Each correct answer represents a complete solution. Choose three.

Hidden implementation

Document the server configuration

Patch proactively

Red team the design

Password propagation

質問 101
At which of the following levels of robustness in DRM must the security functions be immune to widely available tools and specialized tools and resistant to professional tools?

Level 2

Level 4

Level 1

Level 3

質問 102
DRAG DROP
A number of security design patterns are developed for software assurance in general. Drag and drop the appropriate security design patterns in front of their respective descriptions.
Select and Place:

質問 103
You are the project manager for a construction project. The project involves casting of a column in a very narrow space. Because of lack of space, casting it is highly dangerous. High technical skill will be required for casting that column. You decide to hire a local expert team for casting that column. Which of the following types of risk response are you following?

Avoidance

Acceptance

Mitigation

Transference

質問 104
Which of the following ISO standards is entitled as “Information technology – Security techniques – Information security management – Measurement”?

ISO 27003

ISO 27005

ISO 27004

ISO 27006

質問 105
Which of the following describes the acceptable amount of data loss measured in time?

Recovery Point Objective (RPO)

Recovery Time Objective (RTO)

Recovery Consistency Objective (RCO)

Recovery Time Actual (RTA)

The Recovery Point Objective (RPO) describes the acceptable amount of data loss measured in time. It is the point in time to which data must be recovered as defined by the organization. The RPO is generally a definition of what an organization determines is an “acceptable loss” in a disaster situation. If the RPO of a company is 2 hours and the time it takes to get the data back into production is 5 hours, the RPO is still 2 hours. Based on this RPO the data must be restored to within 2 hours of the disaster. Answer B is incorrect. The Recovery Time Objective (RTO) is the duration of time and a service level within which a business process must be restored after a disaster or disruption in order to avoid unacceptable consequences associated with a break in business continuity. It includes the time for trying to fix the problem without a recovery, the recovery itself, tests and the communication to the users. Decision time for user representative is not included. The business continuity timeline usually runs parallel with an incident management timeline and may start at the same, or different, points. In accepted business continuity planning methodology, the RTO is established during the Business Impact Analysis (BIA) by the owner of a process (usually in conjunction with the Business Continuity planner). The RTOs are then presented to senior management for acceptance. The RTO attaches to the business process and not the resources required to support the process. Answer D is incorrect. The Recovery Time Actual (RTA) is established during an exercise, actual event, or predetermined based on recovery methodology the technology support team develops. This is the time frame the technology support takes to deliver the recovered infrastructure to the business. Answer C is incorrect. The Recovery Consistency Objective (RCO) is used in Business Continuity Planning in addition to Recovery Point Objective (RPO) and Recovery Time Objective (RTO). It applies data consistency objectives to Continuous Data Protection services.

質問 106
Which of the following coding practices are helpful in simplifying code? Each correct answer represents a complete solution. Choose all that apply.

Programmers should use multiple small and simple functions rather than a single complex function.

Software should avoid ambiguities and hidden assumptions, recursions, and GoTo statements.

Programmers should implement high-consequence functions in minimum required lines of code and follow proper coding standards.

Processes should have multiple entry and exit points.

質問 107
Which of the following is an example of over-the-air (OTA) provisioning in digital rights management?

Use of shared secrets to initiate or rebuild trust.

Use of software to meet the deployment goals.

Use of concealment to avoid tampering attacks.

Use of device properties for unique identification.

質問 108
Which of the following is a signature-based intrusion detection system (IDS) ?

RealSecure

StealthWatch

Tripwire

Snort

質問 109
The build environment of secure coding consists of some tools that actively support secure specification, design, and implementation. Which of the following features do these tools have? Each correct answer represents a complete solution. Choose all that apply.

They decrease the exploitable flaws and weaknesses.

They reduce and restrain the propagation, extent, and damage that have occurred by insecure software behavior.

They decrease the attack surface.

They employ software security constraints, protections, and services.

They decrease the level of type checking and program analysis.

質問 110
Penetration tests are sometimes called white hat attacks because in a pen test, the good guys are attempting to break in. What are the different categories of penetration testing? Each correct
answer represents a complete solution. Choose all that apply.

Open-box

Closed-box

Zero-knowledge test

Full-box

Full-knowledge test

Partial-knowledge test

質問 111
Which of the following are Service Level Agreement (SLA) structures as defined by ITIL? Each correct answer represents a complete solution. Choose all that apply.

Component Based

Service Based

Segment Based

Customer Based

Multi-Level

質問 112
Which of the following cryptographic system services ensures that information will not be disclosed to any unauthorized person on a local network?

Authentication

Integrity

Non-repudiation

Confidentiality