CISSP-ISSEP Information Systems Security Engineering Professional Questions

dumps2022-02-21T02:41:50+08:00

dumps ISC CISSP-ISSEP exam questions, Information Systems Security Engineering Professional CISSP-ISSEP exam 0 Comments

Information Systems Security Engineering Professional CISSP-ISSEP questions are the best preparation material. In real CISSP-ISSEP exam, there are 125 multiple choice questions, and you have up to 3 hours to write the test. The required passing score of CISSP-ISSEP exam is 700 (out of 1000 points). The available language is English. Free Information Systems Security Engineering Professional CISSP-ISSEP exam questions are below.

Page 1 of 7

1. FITSAF stands for Federal Information Technology Security Assessment Framework. It is a methodology for assessing the security of information systems.

Which of the following FITSAF levels shows that the procedures and controls are tested and reviewed?

Level 4

Level 5

Level 1

Level 2

Level 3

2. Which of the following is a type of security management for computers and networks in order to identify security breaches

IPS

IDS

ASA

EAP

3. Which of the following types of firewalls increases the security of data packets by remembering the state of connection at the network and the session layers as they pass through the filter

Stateless packet filter firewall

PIX firewall

Stateful packet filter firewall

Virtual firewall

4. Which of the following federal laws is designed to protect computer data from theft

Federal Information Security Management Act (FISMA)

Computer Fraud and Abuse Act (CFAA)

Government Information Security Reform Act (GISRA)

Computer Security Act

5. Which of the following is used to indicate that the software has met a defined quality level and is ready for mass distribution either by electronic means or by physical media

ATM

RTM

CRO

DAA

6. Part of your change management plan details what should happen in the change control system for your project. Theresa, a junior project manager, asks what the configuration management activities are for scope changes. You tell her that all of the following are valid configuration management activities except for which one

Configuration Item Costing

Configuration Identification

Configuration Verification and Auditing

Configuration Status Accounting

7. Which of the following professionals is responsible for starting the Certification & Accreditation (C&A) process

Authorizing Official

Information system owner

Chief Information Officer (CIO)

Chief Risk Officer (CRO)

8. Which of the following security controls is a set of layered security services that address communications and data security problems in the emerging Internet and intranet application space

Internet Protocol Security (IPSec)

Common data security architecture (CDSA)

File encryptors

Application program interface (API)

9. Which of the following protocols is used to establish a secure terminal to a remote network device

WEP

SMTP

SSH

IPSec

10. Which of the following elements of Registration task 4 defines the system's external interfaces as well as the purpose of each external interface, and the relationship between the interface and the system

System firmware

System software

System interface

System hardware

Page 2 of 7

11. Which of the following guidelines is recommended for engineering, protecting, managing, processing, and controlling national security and sensitive (although unclassified) information

Federal Information Processing Standard (FIPS)

Special Publication (SP)

NISTIRs (Internal Reports)

DIACAP by the United States Department of Defense (DoD)

12. Which of the following Security Control Assessment Tasks gathers the documentation and supporting materials essential for the assessment of the security controls in the information system

Security Control Assessment Task 4

Security Control Assessment Task 3

Security Control Assessment Task 1

Security Control Assessment Task 2

13. Which of the following professionals plays the role of a monitor and takes part in the organization's configuration management process

Chief Information Officer

Authorizing Official

Common Control Provider

Senior Agency Information Security Officer

14. Which of the following processes culminates in an agreement between key players that a system in its current configuration and operation provides adequate protection controls

Certification and accreditation (C&A)

Risk Management

Information systems security engineering (ISSE)

Information Assurance (IA)

15. The Phase 4 of DITSCAP C&A is known as Post Accreditation. This phase starts after the system has been accredited in Phase 3.

What are the process activities of this phase Each correct answer represents a complete solution. Choose all that apply.

Security operations

Continue to review and refine the SSAA

Change management

Compliance validation

System operations

Maintenance of the SSAA

16. Which of the following email lists is written for the technical audiences, and provides weekly summaries of security issues, new vulnerabilities, potential impact, patches and workarounds, as well as the actions recommended to mitigate risk

Cyber Security Tip

Cyber Security Alert

Cyber Security Bulletin

Technical Cyber Security Alert

17. Which of the following tasks obtains the customer agreement in planning the technical effort

Task 9

Task 11

Task 8

Task 10

18. Which of the following documents were developed by NIST for conducting Certification & Accreditation (C&A) Each correct answer represents a complete solution. Choose all that apply.

NIST Special Publication 800-59

NIST Special Publication 800-60

NIST Special Publication 800-37A

NIST Special Publication 800-37

NIST Special Publication 800-53

NIST Special Publication 800-53A

19. Which of the following elements are described by the functional requirements task Each correct answer represents a complete solution. Choose all that apply.

Coverage

Accuracy

Quality

Quantity

20. Which of the following documents is defined as a source document, which is most useful for the ISSE when classifying the needed security functionality

Information Protection Policy (IPP)

IMM

System Security Context

CONOPS

Page 3 of 7

21. DoD 8500.2 establishes IA controls for information systems according to the Mission Assurance Categories (MAC) and confidentiality levels.

Which of the following MAC levels requires basic integrity and availability?

MAC I

MAC II

MAC IV

MAC III

22. What are the responsibilities of a system owner Each correct answer represents a complete solution. Choose all that apply.

Integrates security considerations into application and system purchasing decisions and development projects.

Ensures that the necessary security controls are in place.

Ensures that adequate security is being provided by the necessary controls, password management, remote access controls, operating system configurations, and so on.

Ensures that the systems are properly assessed for vulnerabilities and must report any to the incident response team and data owner.

23. Which of the following Registration Tasks sets up the business or operational functional description and system identification

Registration Task 2

Registration Task 1

Registration Task 3

Registration Task 4

24. SIMULATION

Fill in the blank with an appropriate section name. _________________ is a section of the SEMP template, which specifies the methods and reasoning planned to build the requisite trade-offs between functionality, performance, cost, and risk.

25. Which of the following federal agencies provides a forum for the discussion of policy issues, sets national policy, and promulgates direction, operational procedures, and guidance for the security of national security systems

National Security AgencyCentral Security Service (NSACSS)

National Institute of Standards and Technology (NIST)

United States Congress

Committee on National Security Systems (CNSS)

26. Which of the following statements is true about residual risks

It can be considered as an indicator of threats coupled with vulnerability.

It is a weakness or lack of safeguard that can be exploited by a threat.

It is the probabilistic risk after implementing all security measures.

It is the probabilistic risk before implementing all security measures.

27. According to U.S. Department of Defense (DoD) Instruction 8500.2, there are eight Information Assurance (IA) areas, and the controls are referred to as IA controls.

Which of the following are among the eight areas of IA defined by DoD Each correct answer represents a complete solution? Choose all that apply.

DC Security Design & Configuration

EC Enclave and Computing Environment

VI Vulnerability and Incident Management

Information systems acquisition, development, and maintenance

28. Certification and Accreditation (C&A or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing systems prior to or after a system is in operation.

Which of the following statements are true about Certification and Accreditation Each correct answer represents a complete solution? Choose two.

Accreditation is a comprehensive assessment of the management, operational, and technical security controls in an information system.

Accreditation is the official management decision given by a senior agency official to authorize operation of an information system.

Certification is a comprehensive assessment of the management, operational, and technical security controls in an information system.

Certification is the official management decision given by a senior agency official to authorize operation of an information system.

29. Which of the following protocols is built in the Web server and browser to encrypt data traveling over the Internet

UDP

SSL

IPSec

HTTP

30. Which of the following configuration management system processes defines which items will be configuration managed, how they are to be identified, and how they are to be documented

Configuration verification and audit

Configuration control

Configuration status accounting

Configuration identification

Page 4 of 7

31. What are the subordinate tasks of the Initiate and Plan IA C&A phase of the DIACAP process Each correct answer represents a complete solution. Choose all that apply.

Develop DIACAP strategy.

Initiate IA implementation plan.

Conduct validation activity.

Assemble DIACAP team.

Assign IA controls.

32. You work as a security engineer for BlueWell Inc.

Which of the following documents will you use as a guide for the security certification and accreditation of Federal Information Systems?

NIST Special Publication 800-59

NIST Special Publication 800-37

NIST Special Publication 800-60

NIST Special Publication 800-53

33. Which of the following documents is described in the statement below It is developed along with all processes of the risk management. It contains the results of the qualitative risk analysis, quantitative risk analysis, and risk response planning.

Risk management plan

Project charter

Quality management plan

Risk register

34. Diane is the project manager of the HGF Project. A risk that has been identified and analyzed in the project planning processes is now coming into fruition.

What individual should respond to the risk with the preplanned risk response

Project sponsor

Risk owner

Diane

Subject matter expert

35. Which of the following refers to a process that is used for implementing information security

Classic information security model

Certification and Accreditation (C&A)

Information Assurance (IA)

Five Pillars model

36. In which of the following phases of the interconnection life cycle as defined by NIST SP 800-47, do the organizations build and execute a plan for establishing the interconnection, including executing or configuring appropriate security controls

Establishing the interconnection

Planning the interconnection

Disconnecting the interconnection

Maintaining the interconnection

37. Which of the following tools demands involvement by upper executives, in order to integrate quality into the business system and avoid delegation of quality functions to junior administrators

ISO 90012000

Benchmarking

SEI-CMM

Six Sigma

38. Which of the following documents contains the threats to the information management, and the security services and controls required to counter those threats

System Security Context

Information Protection Policy (IPP)

CONOPS

IMM

39. Which of the following statements define the role of the ISSEP during the development of the detailed security design, as mentioned in the IATF document Each correct answer represents a complete solution. Choose all that apply.

It identifies the information protection problems that needs to be solved.

It allocates security mechanisms to system security design elements.

It identifies custom security products.

It identifies candidate commercial off-the-shelf (COTS)government off-the-shelf (GOTS) security products.

40. Which of the following individuals is responsible for the oversight of a program that is supported by a team of people that consists of, or be exclusively comprised of contractors

Quality Assurance Manager

Senior Analyst

System Owner

Federal program manager

Page 5 of 7

41. Which of the following agencies serves the DoD community as the largest central resource for DoD and government-funded scientific, technical, engineering, and business-related information available today

DISA

DIAP

DTIC

DARPA

42. You work as a system engineer for BlueWell Inc. You want to verify that the build meets its data requirements, and correctly generates each expected display and report.

Which of the following tests will help you to perform the above task?

Functional test

Reliability test

Performance test

Regression test

43. You work as a system engineer for BlueWell Inc.

Which of the following documents will help you to describe the detailed plans, procedures, and schedules to guide the transition process?

Configuration management plan

Transition plan

Systems engineering management plan (SEMP)

Acquisition plan

44. Which of the following policies describes the national policy on the secure electronic messaging service

NSTISSP No. 11

NSTISSP No. 7

NSTISSP No. 6

NSTISSP No. 101

45. Which of the following is a subset discipline of Corporate Governance focused on information security systems and their performance and risk management

Computer Misuse Act

Clinger-Cohen Act

ISG

Lanham Act

46. Which of the following principles are defined by the IATF model Each correct answer represents a complete solution. Choose all that apply.

The degree to which the security of the system, as it is defined, designed, and implemented, meets the security needs.

The problem space is defined by the customer's mission or business needs.

The systems engineer and information systems security engineer define the solution space, which is driven by the problem space.

Always keep the problem and solution spaces separate.

47. Which of the following cooperative programs carried out by NIST conducts research to advance the nation's technology infrastructure

Manufacturing Extension Partnership

NIST Laboratories

Baldrige National Quality Program

Advanced Technology Program

48. Which of the following persons in an organization is responsible for rejecting or accepting the residual risk for a system

System Owner

Information Systems Security Officer (ISSO)

Designated Approving Authority (DAA)

Chief Information Security Officer (CISO)

49. Which of the following assessment methodologies defines a six-step technical security evaluation

FITSAF

OCTAVE

FIPS 102

DITSCAP

50. What are the subordinate tasks of the Implement and Validate Assigned IA Control phase in the DIACAP process Each correct answer represents a complete solution. Choose all that apply.

Conduct activities related to the disposition of the system data and objects.

Combine validation results in DIACAP scorecard.

Conduct validation activities.

Execute and update IA implementation plan.

Page 6 of 7

51. Which of the following memorandums reminds the Federal agencies that it is required by law and policy to establish clear privacy policies for Web activities and to comply with those policies

OMB M-01-08

OMB M-03-19

OMB M-00-07

OMB M-00-13

52. Lisa is the project manager of the SQL project for her company. She has completed the risk response planning with her project team and is now ready to update the risk register to reflect the risk response.

Which of the following statements best describes the level of detail Lisa should include with the risk responses she has created?

The level of detail must define exactly the risk response for each identified risk.

The level of detail is set of project risk governance.

The level of detail is set by historical information.

The level of detail should correspond with the priority ranking.

53. You work as a security manager for BlueWell Inc. You are going through the NIST SP 800-37 C&A methodology, which is based on four well defined phases. In which of the following phases of NIST SP 800-37 C&A methodology does the security categorization occur

Continuous Monitoring

Initiation

Security Certification

Security Accreditation

54. You work as a systems engineer for BlueWell Inc. You are working on translating system requirements into detailed function criteria.

Which of the following diagrams will help you to show all of the function requirements and their groupings in one diagram?

Activity diagram

Functional flow block diagram (FFBD)

Functional hierarchy diagram

Timeline analysis diagram

55. Which of the following phases of DITSCAP includes the activities that are necessary for the continuing operation of an accredited IT system in its computing environment and for addressing the changing threats that a system faces throughout its life cycle

Phase 1, Definition

Phase 3, Validation

Phase 4, Post Accreditation Phase

Phase 2, Verification

56. Which of the following Security Control Assessment Tasks evaluates the operational, technical, and the management security controls of the information system using the techniques and measures selected or developed

Security Control Assessment Task 3

Security Control Assessment Task 1

Security Control Assessment Task 4

Security Control Assessment Task 2

57. The Phase 2 of DITSCAP C&A is known as Verification. The goal of this phase is to obtain a fully integrated system for certification testing and accreditation.

What are the process activities of this phase Each correct answer represents a complete solution? Choose all that apply.

Assessment of the Analysis Results

Certification analysis

Registration

System development

Configuring refinement of the SSAA

58. You work as a Network Administrator for PassGuide Inc. You need to secure web services of your company in order to have secure transactions.

Which of the following will you recommend for providing security?

HTTP

VPN

SMIME

SSL

59. Which of the following processes illustrate the study of a technical nature of interest to focused audience, and consist of interim or final reports on work made by NIST for external sponsors, including government and non-government sponsors

Federal Information Processing Standards (FIPS)

Special Publication (SP)

NISTIRs (Internal Reports)

DIACAP

60. SIMULATION

Fill in the blank with an appropriate phrase. __________ seeks to improve the quality of process outputs by identifying and removing the causes of defects and variability in manufacturing and business processes.

Page 7 of 7

61. You work as a security engineer for BlueWell Inc. You are working on the ISSE model. In which of the following phases of the ISSE model is the system defined in terms of what security is needed

Define system security architecture

Develop detailed security design

Discover information protection needs

Define system security requirements

62. TQM recognizes that quality of all the processes within an organization contribute to the quality of the product.

Which of the following are the most important activities in the Total Quality Management Each correct answer represents a complete solution? Choose all that apply.

Quality renewal

Maintenance of quality

Quality costs

Quality improvements

63. SIMULATION

Fill in the blank with the appropriate phrase. The ____________ is the risk that remains after the implementation of new or enhanced controls.

64. Which of the following is designed to detect unwanted attempts at accessing, manipulating, and disabling of computer systems through the Internet

DAS

IDS

ACL

Ipsec

65. Which of the following security controls is standardized by the Internet Engineering Task Force (IETF) as the primary network layer protection mechanism

Internet Key Exchange (IKE) Protocol

SMIME

Internet Protocol Security (IPSec)

Secure Socket Layer (SSL)

CISSP-ISSEP Information Systems Security Engineering Professional Questions

CISSP-ISSEP Information Systems Security Engineering Professional Questions

Share this post

Leave a Reply Cancel reply

Related Posts

Updated Questions for CISSP Exam

Real Exam Dumps for CCSP Test

ISC Certification CISSP CAT Exam Great Dumps

Certified Authorization Professional CAP Study Guides

HealthCare Information Security and Privacy Practitioner HCISPP Exam Questions