Examen:

CISSP - (ISC)2 Certified Information Systems Security Professional - Chapter 09

While designing the security for the organization, you realize the importance of not only balancing the objectives of the organization against security goals but also focusing on the shared responsibility of security.

(Choose all that apply.)
1.-Which of the following is considered an element of shared responsibility?
A. Everyone in an organization has some level of security responsibility.
B. Always consider the threat to both tangible and intangible assets.
C. Organizations are responsible to their stakeholders for making good security decisions in order to sustain the organization.
D. When working with third parties, especially with cloud providers, each entity needs to understand their portion of the shared responsibility of performing work operations and maintaining security.
E. Multiple layers of security are required to protect against adversary attempts to gain access to internal sensitive resources.
F. As we become aware of new vulnerabilities and threats, we should consider it our responsibility (if not our duty) to responsibly disclose that information to the proper vendor or to an information sharing center.

Many PC OSs provide functionality that enables them to support the simultaneous execution of multiple applications on single-processor systems.

2.-What term is used to describe this capability?
A. Multistate
B. Multithreading
C. Multitasking
D. Multiprocessing

Based on recent articles about the risk of mobile code and web apps, you want to adjust the security configurations of organizational endpoint devices to minimize the exposure.

3.-On a modern Windows system with the latest version of Microsoft’s browser and all others disabled or blocked, which of the following is of the highest concern?
A. Java
B. Flash
C. JavaScript
D. ActiveX

Your organization is considering deploying a publicly available screen saver to use spare system resources to process sensitive company data.

4.-What is a common security risk when using grid computing solutions that consume available resources from computers over the internet?
A. Loss of data privacy
B. Latency of communication
C. Duplicate work
D. Capacity fluctuation

Your company is evaluating several cloud providers to determine which is the best fit to host your custom services as a custom application solution. There are many aspects of security controls you need to evaluate, but the primary issues include being able to process significant amounts of data in short periods of time, controlling which applications can access which assets, and being able to prohibit VM sprawl or repetition of operations.

5.-Which of the following is not relevant to this selection process?
A. Collections of entities, typically users, but can also be applications and devices, which can be granted or denied access to perform specific tasks or access certain resources or assets
B. A VDI or VMI instance that serves as a virtual endpoint for accessing cloud assets and services
C. The ability of a cloud process to use or consume more resources (such as compute, memory, storage, or networking) when needed
D. A management or security mechanism able to monitor and differentiate between numerous instances of the same VM, service, app, or resource

A large city’s central utility company has seen a dramatic increase in the number of distribution nodes failing or going offline. An APT group was attempting to take over control of the utility company and was responsible for the system failures.

6.-Which of the following systems has the attacker compromised?
A. MFP
B. RTOS
C. SoC
D. SCADA

Your organization is concerned about information leaks due to workers taking home retired equipment.

7.-Which one of the following types of memory might retain information after being removed from a computer and therefore represents a security risk?
A. Static RAM
B. Dynamic RAM
C. Secondary memory
D. Real memory

Your organization is considering the deployment of a DCE to support a massively multiplayer online role-playing game (MMORPG) based on the characters of a popular movie franchise.

8.-What is the primary concern of a DCE that could allow for propagation of malware or making adversarial pivoting and lateral movement easy?
A. Unauthorized user access
B. Identity spoofing
C. Interconnectedness of the components
D. Poor authentication

Your boss wants to automate the control of the building’s HVAC system and lighting in order to reduce costs. He instructs you to keep costs low and use off-the-shelf IoT equipment.

9.-When you are using IoT equipment in a private environment, what is the best way to reduce risk?
A. Use public IP addresses
B. Power off devices when not in use
C. Keep devices current on updates
D. Block access from the IoT devices to the internet

Service-oriented architecture (SOA) constructs new applications or functions out of existing but separate and distinct software services. The resulting application is often new; thus, its security issues are unknown, untested, and unprotected.

10.-Which of the following is a direct extension of SOA that creates single-use functions that can be employed via an API by other software?
A. Cyber-physical systems
B. Fog computing
C. DCS
D. Microservices

A new local VDI has been deployed in the organization. There have been numerous breaches of security due to issues on typical desktop workstations and laptop computers used as endpoints. Many of these issues stemmed from users installing unapproved software or altering the configuration of essential security tools. In an effort to avoid security compromises originating from endpoints in the future, all endpoint devices are now used exclusively as dumb terminals. Thus, no local data storage or application execution is performed on endpoints. Within the VDI, each worker has been assigned a VM containing all of their business necessary software and datasets. These VMs are configured to block the installation and execution of new software code, data files cannot be exported to the actual endpoints, and each time a worker logs out, the used VM is discarded and a clean version copied from a static snapshot replaces it.

11.-What type of system has now been deployed for the workers to use?
A. Cloud services
B. Nonpersistent
C. Thin clients
D. Fog computing

A review of your company’s virtualization of operations determines that the hardware resources supporting the VMs are nearly fully consumed. The auditor asks for the plan and layout of VM systems but is told that no such plan exists.

12.-This reveals that the company is suffering from what issue?
A. Use of EOSL systems
B. VM sprawl
C. Poor cryptography
D. VM escaping

A company server is currently operating at near maximum resource capacity, hosting just seven virtual machines. Management has instructed you to deploy six new applications onto additional VMs without purchasing new hardware since the IT/IS budget is exhausted.

13.-How can this be accomplished?
A. Data sovereignty
B. Infrastructure as code
C. Containerization
D. Serverless architecture

14.-____________ is a cloud computing concept where code is managed by the customer and the platform (i.e., supporting hardware and software) or server is managed by the cloud service provider (CSP). There is always a physical server running the code, but this execution model allows the software designer/architect/programmer/developer to focus on the logic of their code and not have to be concerned about the parameters or limitations of a specific server.
A. Microservices
B. Serverless architecture
C. Infrastructure as code
D. Distributed systems

You have been tasked with designing and implementing a new security policy to address the new threats introduced by the recently installed embedded systems.

15.-What is a security risk of an embedded system that is not commonly found in a standard PC?
A. Software flaws
B. Access to the internet
C. Control of a mechanism in the physical world
D. Power loss

A company is developing a new product to perform simple automated tasks related to indoor gardening. The device will be able to turn lights on and off and control a pump to transfer water. The technology to perform these automated tasks needs to be small and inexpensive. It only needs minimal computational capabilities, does not need networking, and should be able to execute C++ commands natively without the need of an OS. The organization thinks that using an embedded system or a microcontroller may be able to provide the functionality necessary for the product.

16.-Which of the following is the best choice to use for this new product?
A. Arduino
B. RTOS
C. Raspberry Pi
D. FPGA

You are developing a new product that is intended to process data in order to trigger real-world adjustments with minimal latency or delay. The current plan is to embed the code into a ROM chip in order to optimize for mission-critical operations.

17.-What type of solution is most appropriate for this scenario?
A. Containerized application
B. An Arduino
C. DCS
D. RTOS

A major online data service wants to provide better response and access times for its users and visitors. They plan on deploying thousands of mini-web servers to ISPs across the nation. These mini-servers will host the few dozen main pages of their website so that users will be routed to the logically and geographically closest server for optimal performance and minimal latency. Only if a user requests data not on these mini-servers will they be connecting to the centralized main web cluster hosted at the company’s headquarters.

18.-What is this type of deployment commonly known as?
A. Edge computing
B. Fog computing
C. Thin clients
D. Infrastructure as code

You are working on improving your organization’s policy on mobile equipment. Because of several recent and embarrassing breaches, the company wants to increase security through technology as well as user behavior and activities.

19.-What is the most effective means of reducing the risk of losing the data on a mobile device, such as a laptop computer?
A. Defining a strong logon password
B. Minimizing sensitive data stored on the mobile device
C. Using a cable lock
D. Encrypting the hard drive

The CISO has asked you to propose an update to the company’s mobile device security strategy. The main concerns are the intermingling of personal information with business data and complexities of assigning responsibility over device security, management, updates, and repairs.

20.-Which of the following would be the best option to address these issues?
A. Bring your own device (BYOD)
B. Corporate-owned personally enabled (COPE)
C. Choose your own device (CYOD)
D. Corporate-owned