ISC2 CSSLP Exam Dumps

The Phase 2 of DITSCAP C&A is known as Verification. The goal of this phase is to obtain a fully integrated system for certification testing and

accreditation. This phase takes place between the signing of the initial version of the SSAA and the formal accreditation of the system. This

phase verifies security requirements during system development.

Answer C, B, and A are incorrect. These phases do not take place between the signing of the initial version of the SSAA and the formal

accreditation of the system.

A zero-day attack, also known as zero-hour attack, is a computer threat that tries to exploit computer application vulnerabilities which are

unknown to others, undisclosed to the software vendor, or for which no security fix is available. Zero-day exploits (actual code that can use a

security hole to carry out an attack) are used or shared by attackers before the software vendor knows about the vulnerability. User

awareness training is the most effective technique to mitigate such attacks.

Answer A is incorrect. A replay attack is a type of attack in which attackers capture packets containing passwords or digital signatures

whenever packets pass between two hosts on a network. In an attempt to obtain an authenticated connection, the attackers then resend

the captured packet to the system. In this type of attack, the attacker does not know the actual password, but can simply replay the captured

packet.

Answer C is incorrect. Man-in-the-middle attacks occur when an attacker successfully inserts an intermediary software or program

between two communicating hosts. The intermediary software or program allows attackers to listen to and modify the communication packets

passing between the two hosts. The software intercepts the communication packets and then sends the information to the receiving host.

The receiving host responds to the software, presuming it to be the legitimate client.

Answer D is incorrect. A Denial-of-Service (DoS) attack is mounted with the objective of causing a negative impact on the performance

of a computer or network. It is also known as network saturation attack or bandwidth consumption attack. Attackers perform DoS attacks by

sending a large number of protocol packets to a network.

Maria is new for this organization and she does not have any idea regarding the present infrastructure. Therefore, black box testing is best

suited for her.

Blackbox testing is a technique in which the testing team has no knowledge about the infrastructure of the organization. The testers must

first determine the location and extent of the systems before commencing their analysis. This testing technique is costly and time consuming.

Answer B is incorrect. White box testing, also known as Clear box or Glass box testing, takes into account the internal mechanism of a

system or application. The connotations of 'Clear box' and 'Glass box' indicate that a tester has full visibility of the internal workings of the

system. It uses knowledge of the internal structure of an application. It is applicable at the unit, integration, and system levels of the software

testing process. It consists of the following testing methods:

Control flow-based testing

Create a graph from source code.

Describe the flow of control through the control flow graph.

Design test cases to cover certain elements of the graph.

Data flow-based testing

Test connections between variable definitions.

Check variation of the control flow graph.

Set DEF (n) contains variables that are defined at node n.

Set USE (n) are variables that are read.

Answer A is incorrect. Graybox testing is a combination of whitebox testing and blackbox testing. In graybox testing, the test engineer

is equipped with the knowledge of system and designs test cases or test data based on system knowledge. The security tester typically

performs graybox testing to find vulnerabilities in software and network system.

Answer D is incorrect. Unit testing is a type of testing in which each independent unit of an application is tested separately. During unit

testing, a developer takes the smallest unit of an application, isolates it from the rest of the application code, and tests it to determine

whether it works as expected. Unit testing is performed before integrating these independent units into modules. The most common approach

to unit testing requires drivers and stubs to be written. Drivers and stubs are programs. A driver simulates a calling unit, and a stub simulates

a called unit.

The security challenges for DRM are as follows:

Key hiding: It prevents tampering attacks that target the secret keys. In the key hiding process, secret keys are used for

authentication, encryption, and node-locking.

Device fingerprinting: It prevents fraud and provides secure authentication. Device fingerprinting includes the summary of hardware

and software characteristics in order to uniquely identify a device.

OTA provisioning: It provides end-to-end encryption or other secure ways for delivery of copyrighted software to mobile devices.

Answer B is incorrect. Access control is not a security challenge for DRM.

A penetration testing is a method of evaluating the security of a computer system or network by simulating an attack from a malicious source.

The process involves an active analysis of the system for any potential vulnerabilities that may result from poor or improper system

configuration, known or unknown hardware or software flaws, or operational weaknesses in process or technical countermeasures. This

analysis is carried out from the position of a potential attacker, and can involve active exploitation of security vulnerabilities. Any security

issues that are found will be presented to the system owner together with an assessment of their impact and often with a proposal for

mitigation or a technical solution. The intent of a penetration test is to determine feasibility of an attack and the amount of business impact of

a successful exploit, if discovered. It is a component of a full security audit.

Answer C is incorrect. A paper test is the least complex test in the disaster recovery and business continuity testing approaches. In this

test, the BCP/DRP plan documents are distributed to the appropriate managers and BCP/DRP team members for review, markup, and

comment. This approach helps the auditor to ensure that the plan is complete and that all team members are familiar with their

responsibilities within the plan.

Answer D is incorrect. A walk-through test is an extension of the paper testing in the business continuity and disaster recovery

process. In this testing methodology, appropriate managers and BCP/DRP team members discuss and walk through procedures of the plan.

They also discuss the training needs, and clarification of critical plan elements.

Answer A is incorrect. A full operational test includes all team members and participants in the disaster recovery and business

continuity process. This full operation test involves the mobilization of personnel. It restores operations in the same manner as an outage or

disaster would. The full operational test extends the preparedness test by including actual notification, mobilization of resources, processing

of data, and utilization of backup media for restoration.