Important ISC2 CSSLP Exam Questions

Answer: A

Explanation:

ISO 27006 is an information security standard developed by the International Organization for Standardization (ISO) and the International

Electrotechnical Commission (IEC). It is entitled as 'Information technology - Security techniques - Requirements for bodies providing audit

and certification of information security management systems'. The ISO 27006 standard provides guidelines for accreditation of an

organization which is concerned with certification and registration related to ISMS.

The ISO 27006 standard contains the following elements:

Scope

Normative references

Terms and definitions

Principles

General requirements

Structural requirements

Resource requirements

Information requirements

Process requirements

Management system requirements for certification bodies

Information security risk communication

Information security risk monitoring and review

Annex A. Defining the scope of process

Annex B. Asset valuation and impact assessment

Annex C. Examples of typical threats

Annex D. Vulnerabilities and vulnerability assessment methods

Annex E. Information security risk assessment (ISRA) approaches

Answer C is incorrect. The ISO 27003 standard provides guidelines for implementing an ISMS (Information Security Management

System).

Answer D is incorrect. The ISO 27004 standard provides guidelines on specifications and use of measurement techniques for the

assessment of the effectiveness of an implemented information security management system and controls.

Answer B is incorrect. The ISO 27005 standard provides guidelines for information security risk management.

Answer: B

Explanation:

NIST has developed a suite of documents for conducting Certification & Accreditation (C&A). These documents are as follows:

NIST Special Publication 800-37: This document is a guide for the security certification and accreditation of Federal Information

Systems.

NIST Special Publication 800-53: This document provides a guideline for security controls for Federal Information Systems.

NIST Special Publication 800-53A. This document consists of techniques and procedures for verifying the effectiveness of security

controls in Federal Information System.

NIST Special Publication 800-59: This document is a guideline for identifying an information system as a National Security System.

NIST Special Publication 800-60: This document is a guide for mapping types of information and information systems to security

objectives and risk levels.

Answer: A, B, C

Explanation:

The Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) is a process defined by the United States

Department of Defense (DoD) for managing risk.

The subordinate tasks of the Implement and Validate Assigned IA Control phase in the DIACAP process are as follows:

Execute and update IA implementation plan.

Conduct validation activities.

Combine validation results in the DIACAP scorecard.

Answer D is incorrect. The activities related to the disposition of the system data and objects are conducted in the fifth phase of the

DIACAP process. The fifth phase of the DIACAP process is known as Decommission System.

Answer: A

Explanation:

Integrity refers to the ability to ensure that the data is not modified or tampered with.

Integrity means that data cannot be modified without authorization. Integrity is violated when an employee accidentally or with malicious

intent deletes important data files, when a computer virus infects a computer, when an employee is able to modify his own salary in a payroll

database, when an unauthorized user vandalizes a Web site, when someone is able to cast a very large number of votes in an online poll,

and so on.

Answer D is incorrect. Confidentiality is the property of preventing disclosure of information to unauthorized individuals or systems.

Breaches of confidentiality take many forms. Permitting someone to look over your shoulder at your computer screen while you have

confidential data displayed on it could be a breach of confidentiality. If a laptop computer containing sensitive information about a company's

employees is stolen or sold, it could result in a breach of confidentiality.

Answer B is incorrect. Availability means that data must be available whenever it is needed.

Answer C is incorrect. Non-repudiation is the concept of ensuring that a party in a dispute cannot refuse to acknowledge, or refute the

validity of a statement or contract. As a service, it provides proof of the integrity and origin of data. Although this concept can be applied to

any transmission, including television and radio, by far the most common application is in the verification and trust of signatures.

Answer: C

Explanation:

Non repudiation refers to mechanisms that prevent a party from falsely denying involvement in some data transaction.