CISSP Domain 3

Question 1

Alice would like to prove to Charlie that message she received actually came from Bob. Which would enforce Alice's goal?

Accepted Answer

non-repudiation

Question 2

Key ___ adds security to the use of encryption.

Accepted Answer

management

Question 3

What type of fuzz testing captures real software input and modifies it?

Accepted Answer

mutation fuzzing

Question 4

What character is key to a successful SQL injection attack?

Accepted Answer

'

Question 5

Which is NOT a correct statement regarding encryption?

Accepted Answer

longer keys always provide stronger encryption

Question 6

What action can users take to overcome security flaws in RC4?

Accepted Answer

it is not possible to use RC4 securely

Question 7

What type of system is used to gather information from remote sensors via telemetry?

Accepted Answer

SCADA

Question 8

The core issues around BYOD relate to ___.

Accepted Answer

ownership

Question 9

Bob is planning to use cryptographic cipher that rearranges the characters in a message.What type of cipher below to use

Accepted Answer

transposition cipher

Question 10

What technology can you use as a compensating control when it's not possible to patch an embedded system?

Accepted Answer

Wrappers

Question 11

The difficulty of solving what mathematical problem provides the security underlying the Diffie-Hellman algorithm?

Accepted Answer

prime factorization

Question 12

Which of the following DES modes can leave patterns in the ciphertext?

Accepted Answer

ECB mode

Question 13

What algorithm uses the Blowfish cipher along with a salt to strengthen cryptographic keys?

Accepted Answer

Bcrypt

Question 14

Which security evaluation standards was developed by council that includes American Express, Discover, Mastercard, Visa

Accepted Answer

PCI DSS

Question 15

Who provides the digital signature on a digital certificate?

Accepted Answer

certificate authority

Question 16

What key should Alice use to encrypt the message if she wants to send message to Bob using RSA encryption?

Accepted Answer

Bob's public key

Question 17

What basic cryptographic functions does the AES algorithm use to encrypt plaintext?

Accepted Answer

both substitution and transposition

Question 18

Which BEST describes the purpose of a lockdown enclosure?

Accepted Answer

to prevent the theft of computer equipment

Question 19

Which is the BEST example of secondary storage?

Accepted Answer

CD-R

Question 20

Alice wants to send a message to Bob using symmetric cryptography, what key does she use to encrypt the message?

Accepted Answer

shared secret key

Question 21

Which is the BEST example of a state attack?

Accepted Answer

race condition

Question 22

Which one of the following is most susceptible to quantum computing attack?

Accepted Answer

elliptic curve cryptography

Question 23

In what application control approach may users install only approved software on their devices?

Accepted Answer

whitelist

Question 24

Which of the following security architecture model combines Bell-LaPadula and Biba?

Accepted Answer

Lipner

Question 25

What technology allows administrators to pinpoint the location of a mobile device?

Accepted Answer

GPS

Question 26

Which of the following can mitigate the threat of brute-force attacks that use rainbow tables?

Accepted Answer

a salt

Question 27

What is the most important control to apply to smart devices?

Accepted Answer

network segmentation

Question 28

Which one of the following is not a barrier to using the web of trust approach?

Accepted Answer

use of weak cryptography

Question 29

What model of cloud computing does not use any shared tenancy resources?

Accepted Answer

private cloud

Question 30

Which one of the following is not a possible hash length from a SHA-2 function?

Accepted Answer

128 bits

Question 31

What is the best defense against cross-site scripting attacks?

Accepted Answer

input validation

Question 32

Which describes memory protection technique that can mitigate confidentiality attacks by logically segregating processes

Accepted Answer

process isolation

Question 33

What length encryption key does the Data Encryption Standard use?

Accepted Answer

56 bits

Question 34

What operation uses a cryptographic key to convert plaintext into ciphertext?

Accepted Answer

encryption

Question 35

What does an attacker typically have access in a brute-force attack?

Accepted Answer

only cyphertext

Question 36

What technique can be used to hide information in the image?

Accepted Answer

steganography

Question 37

What type of hypervisor runs directly on top of bare hardware?

Accepted Answer

Type 1

Question 38

Which is an example of an in-band approach to key exchange?

Accepted Answer

Diffie-Hellman

Question 39

Apple devices running current versions of iOS use full device encryption by default.

Accepted Answer

True

Question 40

Which one of the following is not an effective defense against XSRF attacks?

Accepted Answer

network segmentation

Question 41

In the early 1990s, the National Security Agency attempted to introduce key escrow using what failed technology?

Accepted Answer

Clipper chip

Question 42

What is the simplest way to take an existing cipher and make it stronger?

Accepted Answer

increase the length of the encryption key

Question 43

Which of the following public cloud tiers places most security responsibility in the vendor?

Accepted Answer

SaaS

Question 44

What key is used to encrypt the contents of a message using PGP?

Accepted Answer

randomly generated key

Question 45

Which BEST describes the purpose of watermarking?

Accepted Answer

to detect unauthorized copying of an image or document

Question 46

Which one of the following is NOT critical to the security of one-time pad operations?

Accepted Answer

using aes in conjunction with one-time pad

Question 47

How many keys should be used with 3DES to achieve the greatest level of security?

Accepted Answer

3

Question 48

Which is accreditation is granted if security issues exist but system is granted temporary operation authorization?

Accepted Answer

IATO

Question 49

Which of the following layers of the ring model typically contains the LEAST privileged applications and processes?

Accepted Answer

Ring 3

Question 50

What two items does a NoSQL database store?

Accepted Answer

keys and values

CISSP Domain 3

Questions 50

CISSP Domain 3

Questions 50