ISC2 CSSLP Exam Dumps

Tamper resistance is resistance tampered by the users of a product, package, or system, or the users who can physically access it. It includes

simple as well as complex devices. The complex device encrypts all the information between individual chips, or renders itself inoperable.

Tamper resistance is generally used in packages in order to determine package or product tampering.

Answer B is incorrect. Tamper evident specifies a process or device that makes unauthorized access to the protected object easily

detected.

Answer D is incorrect. Tamper proofing makes computers resistant to interference. Tamper proofing measures include automatic

removal of sensitive information, automatic shutdown, and automatic physical locking.

Answer C is incorrect. Tamper data is used to view and modify the HTTP or HTTPS headers and post parameters.

The primary functions of configuration management are as follows:

It ensures that the change is implemented in a sequential manner through formalized testing.

It ensures that the user base is informed of the future change.

It analyzes the effect of the change that is implemented on the system.

It reduces the negative impact that the change might have had on the computing services and resources.

Answer A is incorrect. It is not one of the primary functions of configuration management. It is the function of risk avoidance.

The anomaly-based intrusion detection system (IDS) monitors network traffic and compares it against an established baseline. This type of IDS

monitors traffic and system activity for unusual behavior based on statistics. In order to identify a malicious activity, it learns normal behavior

from the baseline. The anomaly-based intrusion detection is also known as behavior-based or statistical-based intrusion detection.

Answer D is incorrect. Signature-based IDS uses a database with signatures to identify possible attacks and malicious activity.

Answer B is incorrect. A network-based IDS can be a dedicated hardware appliance, or an application running on a computer, attached

to the network. It monitors all traffic in a network or traffic coming through an entry-point such as an Internet connection.

Answer A is incorrect. There is no such intrusion detection system (IDS) that is file-based.

Phase 4, Post Accreditation Phase, of the DITSCAP includes the activities that are necessary for the continuing operation of an accredited IT

system in its computing environment and for addressing the changing threats that a system faces throughout its life cycle.

Answer C is incorrect. Phase 1, Definition, focuses on understanding the mission, the environment, and the architecture in order to

determine the security requirements and level of effort necessary to achieve accreditation.

Answer A is incorrect. Phase 2, Verification, verifies the evolving or modified system's compliance with the information agreed on in the

System Security Authorization Agreement (SSAA).

Answer B is incorrect. Phase 3 validates the compliance of a fully integrated system with the information stated in the SSAA.

Security constraint is a type of declarative security, which specifies the protection of web content. It also specifies access privileges to a

collection of resources by using the URL mapping. A deployment descriptor is used to define the security constraint. Security constraint

includes the following elements:

Web resource collection

Authorization constraint

User data constraint

Answer A is incorrect. Code Access Security (CAS), in the Microsoft .NET framework, is Microsoft's solution to prevent untrusted code

from performing privileged actions. When the CLR (common language runtime) loads an assembly it will obtain evidence for the assembly and

use this to identify the code group that the assembly belongs to. A code group contains a permission set (one or more permissions). Code

that performs a privileged action will perform a code access demand, which will cause the CLR to walk up the call stack and examine the

permission set granted to the assembly of each method in the call stack. The code groups and permission sets are determined by the

administrator of the machine who defines the security policy.

Answer D is incorrect. Access Management is used to grant authorized users the right to use a service, while preventing access to non-

authorized users. The Access Management process essentially executes policies defined in IT Security Management. It is sometimes also

referred to as Rights Management or Identity Management. It is part of Service Operation and the owner of Access Management is the

Access Manager. Access Management is added as a new process to ITIL V3. The sub-processes of Access Management are as follows:

Maintain Catalogue of User Roles and Access Profiles

Manage User Access Requests

Answer C is incorrect. Configuration Management (CM) is an Information Technology Infrastructure Library (ITIL) IT Service

Management (ITSM) process. It tracks all of the individual Configuration Items (CI) in an IT system, which may be as simple as a single server,

or as complex as the entire IT department. In large organizations a configuration manager may be appointed to oversee and manage the CM

process.