CISSP試験無料問題集（1811題）「ISC Certified Information Systems Security Professional (CISSP) 認定」

出題：1

Which term describes the amount of time an organization determines it can tolerate the loss of data, typically measured backward from the point of disruption?

A. Recovery Time Objective (RTO)

B. Mean Time to Repair (MTTR)

C. Recovery Point Objective (RPO)

D. Maximum Tolerable Downtime (MTD)

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

Which of the following BEST describes "Golden Ticket" attacks in a Kerberos environment?

A. A one-time password token used for multifactor authentication

B. A digital certificate used for code signing

C. A legitimate administrative ticket issued by the Key Distribution Center

D. A forged Kerberos Ticket Granting Ticket (TGT) created by an attacker who has compromised the KRBTGT account's hash, allowing them to impersonate any user and gain broad, persistent access within the domain

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：3

Single sign-on (SSO) for federated identity management (FIM) must be implemented and managed so that authorization mechanisms protect access to privileged information using OpenID Connect (OIDC) token or Security Assertion Markup Language (SAML) assertion. What is the BEST method to use to protect them?

A. Use a challenge and response mechanism such as Challenge Handshake Authentication Protocol (CHAP).

B. The access token or assertion should be encrypted to ensure privacy.

C. Tokens and assertion should use base64 encoding to assure confidentiality.

D. Pass data in a bearer assertion, only signed by the identity provider.

正解：B 解答を投票する

出題：4

Internet protocol security (IPSec), point-to-point tunneling protocol (PPTP), and secure sockets Layer (SSL) all use Which of the following to prevent replay attacks?

A. Randomly generated nonces

B. Single integrity protection

C. Large Key encryption

D. Embedded sequence numbers

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：5

Which of the following is an initial consideration when developing an information security management system?

A. Understand the value of the information assets

B. Identify the contractual security obligations that apply to the organizations

C. Identify the level of residual risk that is tolerable to management

D. Identify relevant legislative and regulatory compliance requirements

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：6

The World Trade Organization's (WTO) agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS) requires authors of computer software to be given the

A. right to refuse or permit commercial rentals.

B. ability to tailor security parameters based on location.

C. right to disguise the software's geographic origin.

D. ability to confirm license authenticity of their works.

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：7

An organization implements a Remote Access Server (RAS). Once users correct to the server, digital certificates are used to authenticate their identity. What type of Extensible Authentication Protocol (EAP) would the organization use dring this authentication?

A. Transport layer security (TLS)

B. Lightweight Extensible Authentication Protocol (EAP)

C. Subscriber Identity Module (SIM)

D. Message Digest 5 (MD5)

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：8

Which of the following BEST describes the purpose of Border Gateway Protocol (BGP)?

A. Maintain a list of efficient network paths between autonomous systems.

B. Provide Routing Information Protocol (RIP) version 2 advertisements to neighboring layer 3 devices.

C. Maintain a list of network paths between internet routers.

D. Provide firewall services to cloud-enabled applications.

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：9

The process of mutual authentication involves a computer system authenticating a user and authenticating the

A. user's access to all authorized objects.

B. computer system to the user.

C. computer system to the audit process.

D. user to the audit process.

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：10

At a MINIMUM, audits of permissions to individual or group accounts should be scheduled

A. to correspond with staff promotions

B. annually

C. to correspond with terminations

D. continually

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：11

How long should the records on a project be retained?

A. Until five years after the project ends, then move to archives

B. For the duration of the organization fiscal year

C. For the duration of the project, or at the discretion of the record owner

D. Until they are no longer useful or required by policy

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：12

Which of the following BEST describes the concept of "chain of custody" in digital forensics?

A. The hierarchy of forensic analysts on an investigation team

B. The classification level applied to seized evidence

C. The order in which evidence was discovered

D. A documented, unbroken record of who handled evidence, when, and under what circumstances, from collection to presentation

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：13

Which of the following techniques BEST prevents buffer overflows?

A. Variant type and bit length

B. Character set encoding

C. Boundary and perimeter offset

D. Code auditing

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：14

An organization has decided to contract with a cloud-based service provider to leverage their identity as a service offering. They will use Open Authentication (OAuth) 2.0 to authenticate external users to the organization's services. As part of the authentication process, which of the following must the end user provide?

A. A username and password

B. An access token

C. A password

D. A username

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：15

A project manager for a large software firm has acquired a government contract that generates large amounts of Controlled Unclassified Information (CUI). The organization's information security manager has received a request to transfer project-related CUI between systems of differing security classifications. What role provides the authoritative guidance for this transfer?

A. Mission/Business Owner

B. PM

C. Information owner

D. Data Custodian

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

CISSP試験無料問題集「ISC Certified Information Systems Security Professional (CISSP) 認定」