ISC2 Certified Secure Software Lifecycle Professional CSSLP Exam Questions

Answer : B

The National Institute of Standards and Technology (NIST), known between 1901 and 1988 as the National Bureau of Standards (NBS), is a

measurement standards laboratory which is a non-regulatory agency of the United States Department of Commerce. The institute's official

mission is to promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways

that enhance economic security and improve quality of life.

Answer D is incorrect. The Committee on National Security Systems (CNSS) is a United States intergovernmental organization that sets

policy for the security of the US security systems. The CNSS holds discussions of policy issues, sets national policy, directions, operational

procedures, and guidance for the information systems operated by the U.S. Government, its contractors, or agents that contain classified

information, involve intelligence activities, involve cryptographic activities related to national security, etc.

Answer A is incorrect.

The National Security Agency/Central Security Service (NSA/CSS) is a crypto-logic intelligence agency of the United States government. It is

administered as part of the United States Department of Defense. NSA is responsible for the collection and analysis of foreign communications

and foreign signals intelligence, which involves cryptanalysis.

NSA is also responsible for protecting U.S. government communications and information systems from similar agencies elsewhere, which

involves cryptography. NSA is a key component of the U.S. Intelligence Community, which is headed by the Director of National Intelligence.

The Central Security Service is a co-located agency created to coordinate intelligence activities and co-operation between NSA and U.S.

military cryptanalysis agencies. NSA's work is limited to communications intelligence. It does not perform field or human intelligence activities.

Answer C is incorrect. The United States Congress is the bicameral legislature of the federal government of the United States of

America. It consists of the Senate and the House of Representatives. The Congress meets in the United States Capitol in Washington, D.C.

Both senators and representatives are chosen through direct election.

Each of the 435 members of the House of Representatives represents a district and serves a two-year term. House seats are apportioned

among the states by population. The 100 Senators serve staggered six-year terms. Each state has two senators, regardless of population.

Every two years, approximately one-third of the Senate is elected at a time. The United States Congress main function is to make laws. The

Office of the Law Revision Counsel organizes and publishes the United States Code (USC). It is a consolidation and codification by subject

matter of the general and permanent laws of the United States.

Answer : C

Penetration testing is a method of evaluating the security of a computer system or network by simulating an attack from a malicious source,

known as a Black Hat Hacker, or Cracker. The process involves an active analysis of the system for any potential vulnerabilities that may result

from poor or improper system configuration, known and/or unknown hardware or software flaws, or operational weaknesses in process or

technical countermeasures. This analysis is carried out from the position of a potential attacker, and can involve active exploitation of security

vulnerabilities. Any security issues that are found will be presented to the system owner together with an assessment of their impact and

often with a proposal for mitigation or a technical solution. The intent of a penetration testing is to determine feasibility of an attack and the

amount of business impact of a successful exploit, if discovered. It is a component of a full security audit.

Answer A, B, and D are incorrect. Implementing NIDS and HIDS and configuring firewall to block unauthorized traffic are not examples

of penetration testing.

Answer : C

In order to accomplish the task, you should limit the number of Syslog messages or TCP connections from a specific source for a certain time

period. This will prevent a denial of service (DoS) for the Syslog server and the loss of Syslog messages from other sources.

Answer D is incorrect. You can encrypt rotated log files automatically using third-party or OS mechanisms to protect data confidentiality.

Answer A is incorrect. You can use a different message format other than Syslog in order to accept data for aggregating data from

hosts that do not support Syslog.

Answer B is incorrect. You can enable the storage of log entries in both traditional Syslog files and a database for creating a database

storage for logs.

Answer : A

The Information Protection Policy (IPP) is defined as a source document, which is most useful for the ISSE when classifying the needed

security functionality. The IPP document consists of the threats to the information management and the security services and controls needed

to respond to those threats.

Answer B is incorrect. The IMM is the source document describing the customer's needs based on identifying users, processes, and

information.

Answer C is incorrect. The System Security Context is the output of SE and ISSEP. It is the translation of the requirements into system

parameters and possible measurement concepts that meet the defined requirements.

Answer D is incorrect. The Concept of Operations (CONOPS) is a document describing the characteristics of a proposed system from the

viewpoint of an individual who will use that system. It is used to communicate the quantitative and qualitative system characteristics to all

stakeholders. CONOPS are widely used in the military or in government services, as well as other fields.

A CONOPS generally evolves from a concept and is a description of how a set of capabilities may be employed to achieve desired objectives or

a particular end state for a specific scenario.

Answer : B

Configuration control is a procedure of the Configuration management. Configuration control is a set of processes and approval stages

required to change a configuration item's attributes and to re-baseline them. It supports the change of the functional and physical attributes

of software at various points in time, and performs systematic control of changes to the identified attributes.

Answer C is incorrect. Configuration audits confirm that the configuration identification for a configured item is accurate, complete, and

will meet specified program needs. Configuration audits are broken into functional and physical configuration audits. They occur either at

delivery or at the moment of effecting the change.

A functional configuration audit ensures that functional and performance attributes of a configuration item are achieved, while a physical

configuration audit ensures that a configuration item is installed in accordance with the requirements of its detailed design documentation.

Answer D is incorrect. Configuration identification is the process of identifying the attributes that define every aspect of a configuration

item. A configuration item is a product (hardware and/or software) that has an end-user purpose. These attributes are recorded in

configuration documentation and baselined. Baselining an attribute forces formal configuration change control processes to be effected in the

event that these attributes are changed.

Answer A is incorrect. The configuration status accounting procedure is the ability to record and report on the configuration baselines

associated with each configuration item at any moment of time. It supports the functional and physical attributes of software at various points

in time, and performs systematic control of accounting to the identified attributes for the purpose of maintaining software integrity and

traceability throughout the software development life cycle.

Answer : A

A life cycle model helps to provide an insight into the development process and emphasizes on the relationships among the

different activities in this process. This model describes a structured approach to the development and adjustment process involved in

producing and maintaining systems. The life cycle model addresses specifications, design, requirements, verification and validation, and

maintenance activities.

Answer : D

The areas of information system, as separated by Information Assurance Framework, are as follows:

Local Computing Environments: This area includes servers, client workstations, operating system, and applications.

Enclave Boundaries: This area consists of collection of local computing devices, regardless of physical location, that are interconnected

via local area networks (LANs) and governed by a single security policy.

Networks and Infrastructures: This area provides the network connectivity between enclaves. It includes operational area networks

(OANs), metropolitan area networks (MANs), and campus area networks (CANs).

Supporting Infrastructures: This area provides security services for networks, client workstations, Web servers, operating systems,

applications, files, and single-use infrastructure machines.