The new flashcard feature is useful to memorize questions.
?Change your study mode
At any time, you can change the study mode, and alternate between the practice mode and the exam mode. In practice mode, you can configure for example the number of questions or tests, and other parameters to help you study.
Randomized | 10 Questions per Test | 20 Minutes | 70% to pass|
To re-configure your study mode again and change - for example - the number of tests, whether you have random questions and all other configuration parameters.
?Simulator Configuration
Auto-scroll: You can use the automatic scrolling of the questionnaire that occurs as soon as you answer one or all of the answers to a question correctly. Auto scrolling is activated if you answer a single answer, or as soon as you answer all the mandatory answers. Learning Mode: During learning mode you can get a real time result for your answer.
Free Test
Question: / 10
20:00Min. left
?Restart the current test
To restart the current test by clearing all your answers and the time used up to now. Warning: all answers will be lost.
Question: / 10
4.8(1188 Votes)
Quiz
Question 1/101/10
You work as a Network Auditor for Net Perfect Inc. The company has a Windows-based network. While auditing the company's network, you are facing problems in searching the faults and other entities that belong to it. Which of the following risks may occur due to the existence of these problems?
Select the answer:Select the answer
1 correct answer
A.
Residual risk
B.
Secondary risk
C.
Detection risk
D.
Inherent risk
Detection risks are the risks that an auditor will not be able to find what they are looking to detect. Hence, it becomes tedious to report negative results when material conditions (faults) actually exist. Detection risk includes two types of risk: Sampling risk: This risk occurs when an auditor falsely accepts or erroneously rejects an audit sample. Nonsampling risk: This risk occurs when an auditor fails to detect a condition because of not applying the appropriate procedure or using procedures inconsistent with the audit objectives (detection faults). Answer A is incorrect. Residual risk is the risk or danger of an action or an event, a method or a (technical) process that, although being abreast with science, still conceives these dangers, even if all theoretically possible safety measures would be applied (scientifically conceivable measures). The formula to calculate residual risk is (inherent risk) x (control risk) where inherent risk is (threats vulnerability). In the economic context, residual means "the quantity left over at the end of a process; a remainder". Answer D is incorrect. Inherent risk, in auditing, is the risk that the account or section being audited is materially misstated without considering internal controls due to error or fraud. The assessment of inherent risk depends on the professional judgment of the auditor, and it is done after assessing the business environment of the entity being audited. Answer B is incorrect. A secondary risk is a risk that arises as a straight consequence of implementing a risk response. The secondary risk is an outcome of dealing with the original risk. Secondary risks are not as rigorous or important as primary risks, but can turn out to be so if not estimated and planned properly.
Right Answer: C
Quiz
Question 2/102/10
The National Information Assurance Certification and Accreditation Process (NIACAP) is the minimum standard process for the certification and accreditation of computer and telecommunications systems that handle U.S. national security information. Which of the following participants are required in a NIACAP security assessment? Each correct answer represents a part of the solution. Choose all that apply.
Select multiple answer: (Choose 4)Select the answer
4 correct answers
A.
Certification agent
B.
Designated Approving Authority
C.
IS program manager
D.
Information Assurance Manager
E.
User representative
The NIACAP roles are nearly the same as the DITSCAP roles. Four minimum participants (roles) are required to perform a NIACAP security assessment: IS program manager: The IS program manager is the primary authorization advocate. He is responsible for the Information Systems (IS) throughout the life cycle of the system development. Designated Approving Authority (DAA): The Designated Approving Authority (DAA), in the United States Department of Defense, is the official with the authority to formally assume responsibility for operating a system at an acceptable level of risk. Certification agent: The certification agent is also referred to as the certifier. He provides the technical expertise to conduct the certification throughout the system life cycle. User representative: The user representative focuses on system availability, access, integrity, functionality, performance, and confidentiality in a Certification and Accreditation (C&A) process. Answer D is incorrect. Information Assurance Manager (IAM) is one of the key participants in the DIACAP process.
Right Answer: A, B, C, E
Quiz
Question 3/103/10
DRAG DROP
Drop the appropriate value to complete the formula.
Check the image below to see the right answer:Select the answer
1 correct answer
A Single Loss Expectancy (SLE) is the value in dollar ($) that is assigned to a single event. The SLE can be calculated by the following formula: SLE = Asset Value ($) X Exposure Factor (EF) The Exposure Factor (EF) represents the % of assets loss caused by a threat. The EF is required to calculate the Single Loss Expectancy (SLE). The Annualized Loss Expectancy (ALE) can be calculated by multiplying the Single Loss Expectancy (SLE) with the Annualized Rate of Occurrence (ARO). Annualized Loss Expectancy (ALE) = Single Loss Expectancy (SLE) X Annualized Rate of Occurrence (ARO) Annualized Rate of Occurrence (ARO) is a number that represents the estimated frequency in which a threat is expected to occur. It is calculated based upon the probability of the event occurring and the number of employees that could make that event occur.
Right Answer: A
Quiz
Question 4/104/10
Which of the following penetration testing techniques automatically tests every phone line in an exchange and tries to locate modems that are attached to the network?
Select the answer:Select the answer
1 correct answer
A.
Demon dialing
B.
Sniffing
C.
Social engineering
D.
Dumpster diving
The demon dialing technique automatically tests every phone line in an exchange and tries to locate modems that are attached to the network. Information about these modems can then be used to attempt external unauthorized access. Answer B is incorrect. In sniffing, a protocol analyzer is used to capture data packets that are later decoded to collect information such as passwords or infrastructure configurations. Answer D is incorrect. Dumpster diving technique is used for searching paper disposal areas for unshredded or otherwise improperly disposed-of reports. Answer C is incorrect. Social engineering is the most commonly used technique of all, getting information (like passwords) just by asking for them.
Right Answer: A
Quiz
Question 5/105/10
Which of the following roles is also known as the accreditor?
Select the answer:Select the answer
1 correct answer
A.
Data owner
B.
Chief Risk Officer
C.
Chief Information Officer
D.
Designated Approving Authority
Designated Approving Authority (DAA) is also known as the accreditor. Answer A is incorrect. The data owner (information owner) is usually a member of management, in charge of a specific business unit, and is ultimately responsible for the protection and use of a specific subset of information. Answer B is incorrect. A Chief Risk Officer (CRO) is also known as Chief Risk Management Officer (CRMO). The Chief Risk Officer or Chief Risk Management Officer of a corporation is the executive accountable for enabling the efficient and effective governance of significant risks, and related opportunities, to a business and its various segments. Risks are commonly categorized as strategic, reputational, operational, financial, or compliance-related. CRO's are accountable to the Executive Committee and The Board for enabling the business to balance risk and reward. In more complex organizations, they are generally responsible for coordinating the organization's Enterprise Risk Management (ERM) approach. Answer C is incorrect. The Chief Information Officer (CIO), or Information Technology (IT) director, is a job title commonly given to the most senior executive in an enterprise responsible for the information technology and computer systems that support enterprise goals. The CIO plays the role of a leader and reports to the chief executive officer, chief operations officer, or chief financial officer. In military organizations, they report to the commanding officer.
Right Answer: D
Quiz
Question 6/106/10
DoD 8500.2 establishes IA controls for information systems according to the Mission Assurance Categories (MAC) and confidentiality levels. Which of the following MAC levels requires high integrity and medium availability?
Select the answer:Select the answer
1 correct answer
A.
MAC III
B.
MAC IV
C.
MAC I
D.
MAC II
The various MAC levels are as follows: MAC I: It states that the systems have high availability and high integrity. MAC II: It states that the systems have high integrity and medium availability. MAC III: It states that the systems have basic integrity and availability.
Right Answer: D
Quiz
Question 7/107/10
Microsoft software security expert Michael Howard defines some heuristics for determining code review in "A Process for Performing Security Code Reviews". Which of the following heuristics increase the application's attack surface? Each correct answer represents a complete solution. Choose all that apply.
Select multiple answer: (Choose 4)Select the answer
4 correct answers
A.
Code written in C/C++/assembly language
B.
Code listening on a globally accessible network interface
C.
Code that changes frequently
D.
Anonymously accessible code
E.
Code that runs by default
F.
Code that runs in elevated context
Microsoft software security expert Michael Howard defines the following heuristics for determining code review in "A Process for Performing Security Code Reviews": Old code: Newer code provides better understanding of software security and has lesser number of vulnerabilities. Older code must be checked deeply. Code that runs by default: It must have high quality, and must be checked deeply than code that does not execute by default. Code that runs by default increases the application's attack surface. Code that runs in elevated context: It must have higher quality. Code that runs in elevated privileges must be checked deeply and increases the application's attack surface. Anonymously accessible code: It must be checked deeply than code that only authorized users and administrators can access, and it increases the application's attack surface. Code listening on a globally accessible network interface: It must be checked deeply for security vulnerabilities and increases the application's attack surface. Code written in C/C++/assembly language: It is prone to security vulnerabilities, for example, buffer overruns. Code with a history of security vulnerabilities: It includes additional vulnerabilities except concerted efforts that are required for removing them. Code that handles sensitive data: It must be checked deeply to ensure that data is protected from unintentional disclosure. Complex code: It includes undiscovered errors because it is more difficult to analyze complex code manually and programmatically. Code that changes frequently: It has more security vulnerabilities than code that does not change frequently.
Right Answer: B, D, E, F
Quiz
Question 8/108/10
Which of the following cryptographic system services ensures that information will not be disclosed to any unauthorized person on a local network?
Select the answer:Select the answer
1 correct answer
A.
Authentication
B.
Integrity
C.
Non-repudiation
D.
Confidentiality
The confidentiality service of a cryptographic system ensures that information will not be disclosed to any unauthorized person on a local network.
Right Answer: D
Quiz
Question 9/109/10
What are the various activities performed in the planning phase of the Software Assurance Acquisition process? Each correct answer represents a complete solution. Choose all that apply.
Select multiple answer: (Choose 3)Select the answer
3 correct answers
A.
Develop software requirements.
B.
Implement change control procedures.
C.
Develop evaluation criteria and evaluation plan.
D.
Create acquisition strategy.
The various activities performed in the planning phase of the Software Assurance Acquisition process are as follows: Determine software product or service requirements. Identify associated risks. Develop software requirements. Create acquisition strategy. Develop evaluation criteria and evaluation plan. Define development and use of SwA due diligence questionnaires. Answer B is incorrect. This activity is performed in the monitoring and acceptance phase of the Software Assurance acquisition process.
Right Answer: A, C, D
Quiz
Question 10/1010/10
You work as a project manager for BlueWell Inc. You are working on a project and the management wants a rapid and cost-effective means for establishing priorities for planning risk responses in your project. Which risk management process can satisfy management's objective for your project?
Select the answer:Select the answer
1 correct answer
A.
Qualitative risk analysis
B.
Historical information
C.
Rolling wave planning
D.
Quantitative analysis
Qualitative risk analysis is the best answer as it is a fast and low-cost approach to analyze the risk impact and its effect. It can promote certain risks onto risk response planning. Qualitative Risk Analysis uses the likelihood and impact of the identified risks in a fast and cost- effective manner. Qualitative Risk Analysis establishes a basis for a focused quantitative analysis or Risk Response Plan by evaluating the precedence of risks with a concern to impact on the project's scope, cost, schedule, and quality objectives. The qualitative risk analysis is conducted at any point in a project life cycle. The primary goal of qualitative risk analysis is to determine proportion of effect and theoretical response. The inputs to the Qualitative Risk Analysis process are: Organizational process assets Project Scope Statement Risk Management Plan Risk Register Answer B is incorrect. Historical information can be helpful in the qualitative risk analysis, but it is not the best answer for the question as historical information is not always available (consider new projects). Answer D is incorrect. Quantitative risk analysis is in-depth and often requires a schedule and budget for the analysis. Answer C is incorrect. Rolling wave planning is not a valid answer for risk analysis processes.
CSSLP: Certified Secure Software Lifecycle Professional Practice test unlocks all online simulator questions
Thank you for choosing the free version of the CSSLP: Certified Secure Software Lifecycle Professional practice test! Further deepen your knowledge on ISC Simulator; by unlocking the full version of our CSSLP: Certified Secure Software Lifecycle Professional Simulator you will be able to take tests with over 357 constantly updated questions and easily pass your exam. 98% of people pass the exam in the first attempt after preparing with our 357 questions.
What to expect from our CSSLP: Certified Secure Software Lifecycle Professional practice tests and how to prepare for any exam?
The CSSLP: Certified Secure Software Lifecycle Professional Simulator Practice Tests are part of the ISC Database and are the best way to prepare for any CSSLP: Certified Secure Software Lifecycle Professional exam. The CSSLP: Certified Secure Software Lifecycle Professional practice tests consist of 357 questions and are written by experts to help you and prepare you to pass the exam on the first attempt. The CSSLP: Certified Secure Software Lifecycle Professional database includes questions from previous and other exams, which means you will be able to practice simulating past and future questions. Preparation with CSSLP: Certified Secure Software Lifecycle Professional Simulator will also give you an idea of the time it will take to complete each section of the CSSLP: Certified Secure Software Lifecycle Professional practice test . It is important to note that the CSSLP: Certified Secure Software Lifecycle Professional Simulator does not replace the classic CSSLP: Certified Secure Software Lifecycle Professional study guides; however, the Simulator provides valuable insights into what to expect and how much work needs to be done to prepare for the CSSLP: Certified Secure Software Lifecycle Professional exam.
CSSLP: Certified Secure Software Lifecycle Professional Practice test therefore represents an excellent tool to prepare for the actual exam together with our ISC practice test . Our CSSLP: Certified Secure Software Lifecycle Professional Simulator will help you assess your level of preparation and understand your strengths and weaknesses. Below you can read all the quizzes you will find in our CSSLP: Certified Secure Software Lifecycle Professional Simulator and how our unique CSSLP: Certified Secure Software Lifecycle Professional Database made up of real questions:
Info quiz:
Quiz name:CSSLP: Certified Secure Software Lifecycle Professional
Total number of questions:357
Number of questions for the test:50
Pass score:80%
You can prepare for the CSSLP: Certified Secure Software Lifecycle Professional exams with our mobile app. It is very easy to use and even works offline in case of network failure, with all the functions you need to study and practice with our CSSLP: Certified Secure Software Lifecycle Professional Simulator.
Use our Mobile App, available for both Android and iOS devices, with our CSSLP: Certified Secure Software Lifecycle Professional Simulator . You can use it anywhere and always remember that our mobile app is free and available on all stores.
Our Mobile App contains all CSSLP: Certified Secure Software Lifecycle Professional practice tests which consist of 357 questions and also provide study material to pass the final CSSLP: Certified Secure Software Lifecycle Professional exam with guaranteed success.
Our CSSLP: Certified Secure Software Lifecycle Professional database contain hundreds of questions and ISC Tests related to CSSLP: Certified Secure Software Lifecycle Professional Exam. This way you can practice anywhere you want, even offline without the internet.
