ISC2 CSSLP Exam Dumps

Following are the different types of policies:

Regulatory: This type of policy ensures that the organization is following standards set by specific industry regulations. This policy type

is very detailed and specific to a type of industry. This is used in financial institutions, health care facilities, public utilities, and other

government-regulated industries, e.g., TRAI.

Advisory: This type of policy strongly advises employees regarding which types of behaviors and activities should and should not take

place within the organization. It also outlines possible ramifications if employees do not comply with the established behaviors and

activities. This policy type can be used, for example, to describe how to handle medical information, handle financial transactions, or

process confidential information.

Informative: This type of policy informs employees of certain topics. It is not an enforceable policy, but rather one to teach individuals

about specific issues relevant to the company. It could explain how the company interacts with partners, the company's goals and

mission, and a general reporting structure in different situations.

Answer B is incorrect. No such type of policy exists.

Declarative security applies the security policies on the software applications at their runtime. In this type of security, the security decisions

are based on explicit statements that confine security behavior. Declarative security applies security permissions that are required for the

software application to access the local resources and provides role-based access control to an individual software component and software

application. It is employed in a layer that relies outside of the software code or uses attributes of the code.

Answer C is incorrect. In declarative security, authentication decisions are coarse-grained in nature from an operational or external

security perspective.

The scope and plan initiation process in BCP symbolizes the beginning of the BCP process. It emphasizes on creating the scope and the

additional elements required to define the parameters of the plan.

The scope and plan initiation phase embodies a check of the company's operations and support services. The scope activities include creating

a detailed account of the work required, listing the resources to be used, and defining the management practices to be employed.

Answer C is incorrect. The business impact assessment is a method used to facilitate business units to understand the impact of a

disruptive event. This phase includes the execution of a vulnerability assessment. This process makes out the mission-critical areas and

business processes that are important for the survival of business.

It is similar to the risk assessment process. The function of a business impact assessment process is to create a document, which is used to

help and understand what impact a disruptive event would have on the business.

Answer A is incorrect. The business continuity plan development refers to the utilization of the information collected in the Business

Impact Analysis (BIA) for the creation of the recovery strategy plan to support the critical business functions. The information gathered from

the BIA is mapped out to make a strategy for creating a continuity plan. The business continuity plan development process includes the areas

of plan implementation, plan testing, and ongoing plan maintenance. This phase also consists of defining and documenting the continuity

strategy.

Answer B is incorrect. The plan approval and implementation process involves creating enterprise-wide awareness of the plan, getting

the final senior management signoff, and implementing a maintenance procedure for updating the plan as required.

Preventive transformation increases the difficulty for a de-obfuscation tool so that it cannot extract the true application from the obfuscated version.

The risk management plan, part of the comprehensive management plan, defines how risks will be identified, analyzed, monitored and

controlled, and even responded to.

A Risk management plan is a document arranged by a project manager to estimate the effectiveness, predict risks, and build response plans

to mitigate them. It also consists of the risk assessment matrix.

Risks are built in with any project, and project managers evaluate risks repeatedly and build plans to address them. The risk management

plan consists of analysis of possible risks with both high and low impacts, and the mitigation strategies to facilitate the project and avoid

being derailed through which the common problems arise. Risk management plans should be timely reviewed by the project team in order to

avoid having the analysis become stale and not reflective of actual potential project risks. Most critically, risk management plans include a risk

strategy for project execution.

Answer C is incorrect. The project management plan is a comprehensive plan that communicates the intent of the project for all project

management knowledge areas.

Answer B is incorrect. The project plan is not an official PMBOK project management plan.

Answer D is incorrect. The resource management plan defines the management of project resources, such as project team members,

facilities, equipment, and contractors.