- Email support@dumps4free.com
Topic 1: Volume A
The LeGrand Vulnerability-Oriented Risk Management method is based on vulnerability analysis and consists of four principle steps. Which of the following processes does the risk assessment step include? Each correct answer represents a part of the solution. Choose all that apply.
A.
Remediation of a particular vulnerability
B.
Cost-benefit examination of countermeasures
C.
Identification of vulnerabilities
D.
Assessment of attacks
Cost-benefit examination of countermeasures
Identification of vulnerabilities
Assessment of attacks
Explanation: Risk assessment includes identification of vulnerabilities, assessment of losses caused by threats materialized, cost-benefit examination of countermeasures, and assessment of attacks. Answer: A is incorrect. This process is included in the vulnerability management.
Which of the following is a name, symbol, or slogan with which a product is identified?
A.
Trademark
B.
Copyright
C.
Trade secret
D.
Patent
Trademark
Explanation: A trademark is a name, symbol, or slogan with which a product is identified. Its uniqueness makes the product noticeable among the same type of products. For example, Pentium and Athlon are brand names of the CPUs that are manufactured by Intel and AMD, respectively. The trademark law protects a company's trademark by making it illegal for other companies to use it without taking prior permission of the trademark owner. A trademark is registered so that others cannot use identical or similar marks. Answer: C is incorrect. A trade secret is a formula, practice, process, design, instrument, pattern, or compilation of information which is not generally known. It helps a business to obtain an economic advantage over its competitors or customers. In some jurisdictions, such secrets are referred to as confidential information or classified information. Answer: B is incorrect. A copyright is a form of intellectual property, which secures to its holder the exclusive right to produce copies of his or her works of original expression, such as a literary work, movie, musical work or sound recording, painting, photograph, computer program, or industrial design, for a defined, yet extendable, period of time. It does not cover ideas or facts. Copyright laws protect intellectual property from misuse by other individuals. Answer: D is incorrect. A patent is a set of exclusive rights granted to anyone who invents any new and useful machine, process, composition of matter, etc. A patent enables the inventor to legally enforce his right to exclude others from using his invention.
In which of the following cryptographic attacking techniques does an attacker obtain encrypted messages that have been encrypted using the same encryption algorithm?
A.
Chosen plaintext attack
B.
Chosen ciphertext attack
C.
Ciphertext only attack
D.
Known plaintext attack
Ciphertext only attack
Explanation: In a ciphertext only attack, an attacker obtains encrypted messages that have been encrypted using the same encryption algorithm.
The Information System Security Officer (ISSO) and Information System Security Engineer (ISSE) play the role of a supporter and advisor, respectively. Which of the following statements are true about ISSO and ISSE? Each correct answer represents a complete solution. Choose all that apply.
A.
An ISSE manages the security of the information system that is slated for Certification & Accreditation (C&A).
B.
An ISSE provides advice on the continuous monitoring of the information system.
C.
An ISSO manages the security of the information system that is slated for Certification & Accreditation (C&A).
D.
An ISSE provides advice on the impacts of system changes. E. An ISSO takes part in the development activities that are required to implement system changes.
An ISSE provides advice on the continuous monitoring of the information system.
An ISSO manages the security of the information system that is slated for Certification & Accreditation (C&A).
An ISSE provides advice on the impacts of system changes. E. An ISSO takes part in the development activities that are required to implement system changes.
Explanation: An Information System Security Officer (ISSO) plays the role of a supporter. The responsibilities of an Information System Security Officer (ISSO) are as follows: Manages the security of the information system that is slated for Certification & Accreditation (C&A). Insures the information systems configuration with the agency's information security policy. Supports the information system owner/information owner for the completion of security-related responsibilities. Takes part in the formal configuration management process. Prepares Certification & Accreditation (C&A) packages. An Information System Security Engineer (ISSE) plays the role of an advisor. The responsibilities of an Information System Security Engineer are as follows: Provides view on the continuous monitoring of the information system. Provides advice on the impacts of system changes. Takes part in the configuration management process. Takes part in the development activities that are required to implement system changes. Follows approved system changes.
You and your project team have identified the project risks and now are analyzing the probability and impact of the risks. What type of analysis of the risks provides a quick and high-level review of each identified risk event?
A.
Quantitative risk analysis
B.
Qualitative risk analysis
C.
Seven risk responses
D.
A risk probability-impact matrix
Qualitative risk analysis
Explanation: Qualitative risk analysis is a high-level, fast review of the risk event. Qualitative risk analysis qualifies the risk events for additional analysis.
| Page 5 out of 70 Pages |
| Previous |