Important ISC2 CSSLP Exam Questions

Answer: C

Explanation:

Microsoft Baseline Security Analyzer (MBSA) is a tool that includes a graphical and command line interface that can perform local or remote

scans of Windows systems. It runs on computers running Windows 2000, Windows XP, or Windows Server 2003 operating system. MBSA

scans for common security misconfigurations in Windows NT 4.0, Windows 2000, Windows XP, Windows Server 2003, Internet Information

Server (IIS) 4.0 and above, SQL Server 7.0 and 2000, and Office 2000 and 2002. It also scans for missing hot fixes in several Microsoft

products, such as Windows 2000, Windows XP, SQL Server etc.

Answer B, D, and A are incorrect. These are invalid options.

Answer: C

Explanation:

The Clark-Wilson security model dictates that subjects can only access objects through applications.

Answer A is incorrect. The Biba model does not let subjects write to objects at a higher integrity level.

Answer B is incorrect. The Bell-LaPadula model has a simple security rule, which means a subject cannot read data from a higher level.

Answer D is incorrect. There is no such model as Biba-Clark model.

Answer: A, C

Explanation:

The Biba and Clark-Wilson access control models are used in the commercial sector.

The Biba model is a formal state transition system of computer security policy that describes a set of access control rules designed to ensure

data integrity. Data and subjects are grouped into ordered levels of integrity. The model is designed so that subjects may not corrupt data in

a level ranked higher than the subject, or be corrupted by data from a lower level than the subject.

The Clark-Wilson security model provides a foundation for specifying and analyzing an integrity policy for a computing system.

Answer D is incorrect. The Bell-LaPadula access control model is mainly used in military systems.

Answer B is incorrect. There is no such access control model as Clark-Biba.

Answer: D

Explanation:

Snort is a signature-based intrusion detection system.

Snort is an open source network intrusion prevention and detection system that operates as a network sniffer. It logs activities of the

network that is matched with the predefined signatures. Signatures can be designed for a wide range of traffic, including Internet Protocol

(IP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Internet Control Message Protocol (ICMP).

The three main modes in which Snort can be configured are as follows:

Sniffer mode: It reads the packets of the network and displays them in a continuous stream on the console.

Packet logger mode: It logs the packets to the disk.

Network intrusion detection mode: It is the most complex and configurable configuration, allowing Snort to analyze network traffic for

matches against a user-defined rule set.

Answer B is incorrect. StealthWatch is a behavior-based intrusion detection system.

Answer A is incorrect. RealSecure is a network-based IDS that monitors TCP, UDP and ICMP traffic and is configured to look for attack

patterns.

Answer C is incorrect. Tripwire is a file integrity checker for UNIX/Linux that can be used for host-based intrusion detection.

Answer: A, B, C, D

Explanation:

The elements of security are as follows:

1.Confidentiality: It is the concealment of information or resources.

2.Authenticity: It is the identification and assurance of the origin of information.

3.Integrity: It refers to the trustworthiness of data or resources in terms of preventing improper and unauthorized changes.

4.Availability: It refers to the ability to use the information or resources as desired.