Discount Offer! Use Coupon Code to get 20% OFF DO2022
Recent CSSLP Exam Result
Our CSSLP dumps are key to get access. More than 3446+ satisfied customers.
28
Customers Passed CSSLP Exam Today
96%
Maximum Passing Score in Real CSSLP Exam
95%
Guaranteed Questions came from our CSSLP dumps
What is ISC2 CSSLP Exam ?
The ISC2 Certified Secure Software Lifecycle Professional (CSSLP) exam is a professional certification exam offered by the Information Systems Security Certification Consortium (ISC2). It is designed to assess the knowledge and skills of candidates in the following areas:
The CSSLP exam is typically taken by candidates who have at least three years of cumulative paid work experience in one or more of the six domains of the CSSLP Common Body of Knowledge (CBK).
The CSSLP exam is a computer-based exam that consists of 125 multiple-choice questions. The exam is 3 hours long. The passing score is 70%.
To prepare for the CSSLP exam, candidates should review the CSSLP CBK. The CBK covers all of the topics that are tested on the exam. Candidates should also take practice exams and review their results to identify areas where they need additional preparation.
Get ready to ace your ISC2 certification exam with our top-notch CSSLP Dumps! Our CSSLP exam dumps are designed to provide you with the most comprehensive and up-to-date ISC2 study CSSLP Material and question answers. With our dumps, you'll be well-prepared to tackle the toughest CSSLP exam questions, giving you the confidence to pass with flying colors! Don't waste your time with subpar study CSSLPterials - choose our CSSLP dumps and get the results you deserve. Get your hands on our CSSLP study CSSLPterial today and become an CSSLP certified professional in no time! Order now and avail our exclusive discount on ISC2 dumps.
CSSLP Sample Question Answers
Question 1
In which type of access control do user ID and password system come under?
A. Physical B. Technical C. Power D. Administrative
Answer: B
Explanation: Technical access controls include IDS systems, encryption, network
segmentation, and antivirus controls. Answer: D is incorrect. The policies and procedures
implemented by an organization come under administrative access controls. Answer: A is
incorrect. Security guards, locks on the gates, and alarms come under physical access
controls. Answer: C is incorrect. There is no such type of access control as power control.
Question 2
Which of the following phases of NIST SP 800-37 C&A methodology examines the residualrisk for acceptability, and prepares the final security accreditation package?
A. Security Accreditation B. Initiation C. Continuous Monitoring D. Security Certification
Answer: A
Explanation: The various phases of NIST SP 800-37 C&A are as follows: Phase 1:
Initiation- This phase includes preparation, notification and resource identification. It
performs the security plan analysis, update, and acceptance. Phase 2: Security
Certification- The Security certification phase evaluates the controls and documentation.
Phase 3: Security Accreditation- The security accreditation phase examines the residual
risk for acceptability, and prepares the final security accreditation package. Phase 4:
Continuous Monitoring-This phase monitors the configuration management and control,
ongoing security control verification, and status reporting and documentation.
Question 3
The Systems Development Life Cycle (SDLC) is the process of creating or altering thesystems; and the models and methodologies that people use to develop these systems.Which of the following are the different phases of system development life cycle? Eachcorrect answer represents a complete solution. Choose all that apply.
A. Testing B. Implementation C. Operation/maintenance D. Development/acquisition E. Disposal F. Initiation
Answer: B,C,D,E,F
Explanation: The Systems Development Life Cycle (SDLC), or Software Development Life
Cycle in systems engineering, information systems, and software engineering, is the
process of creating or altering the systems; and the models and methodologies that people
use to develop these systems. The concept generally refers to computers or information
systems. The following are the five phases in a generic System Development Life Cycle:
Which of the following describes the acceptable amount of data loss measured in time?
A. Recovery Point Objective (RPO) B. Recovery Time Objective (RTO) C. Recovery Consistency Objective (RCO) D. Recovery Time Actual (RTA)
Answer: A
Explanation: The Recovery Point Objective (RPO) describes the acceptable amount of
data loss measured in time. It is the point in time to which data must be recovered as
defined by the organization. The RPO is generally a definition of what an organization
determines is an "acceptable loss" in a disaster situation. If the RPO of a company is 2
hours and the time it takes to get the data back into production is 5 hours, the RPO is still 2
hours. Based on this RPO the data must be restored to within 2 hours of the disaster.
Answer: B is incorrect. The Recovery Time Objective (RTO) is the duration of time and a
service level within which a business process must be restored after a disaster or
disruption in order to avoid unacceptable consequences associated with a break in
business continuity. It includes the time for trying to fix the problem without a recovery, the
recovery itself, tests and the communication to the users. Decision time for user
representative is not included. The business continuity timeline usually runs parallel with an
incident management timeline and may start at the same, or different, points. In accepted
business continuity planning methodology, the RTO is established during the Business
Impact Analysis (BIA) by the owner of a process (usually in conjunction with the Business
Continuity planner). The RTOs are then presented to senior management for acceptance.
The RTO attaches to the business process and not the resources required to support the
process. Answer: D is incorrect. The Recovery Time Actual (RTA) is established during an
exercise, actual event, or predetermined based on recovery methodology the technology
support team develops. This is the time frame the technology support takes to deliver the
recovered infrastructure to the business. Answer: C is incorrect. The Recovery Consistency
Objective (RCO) is used in Business Continuity Planning in addition to Recovery Point
Objective (RPO) and Recovery Time Objective (RTO). It applies data consistency
objectives to Continuous Data Protection services.
Question 5
Rob is the project manager of the IDLK Project for his company. This project has a budgetof $5,600,000 and is expected to last 18 months. Rob has learned that a new law mayaffect how the project is allowed to proceed - even though the organization has alreadyinvested over $750,000 in the project. What risk response is the most appropriate for thisinstance?
A. Transference B. Enhance C. Mitigation D. Acceptance
Answer: D
Explanation: At this point all that Rob can likely do is accepting the risk event. Because
this is an external risk, there is little that Rob can do other than document the risk and
share the new with management and the project stakeholders. If the law is passed then
Rob can choose the most appropriate way for the project to continue. Acceptance
response is a part of Risk Response planning process. Acceptance response delineates
that the project plan will not be changed to deal with the risk. Management may develop a
contingency plan if the risk does occur. Acceptance response to a risk event is a strategy
that can be used for risks that pose either threats or opportunities. Acceptance response
can be of two types: Passive acceptance: It is a strategy in which no plans are made to try
or avoid or mitigate the risk. Active acceptance: Such responses include developing
contingency reserves to deal with risks, in case they occur. Acceptance is the only
response for both threats and opportunities. Answer: B is incorrect. Mitigation aims to lower
the probability and/or impact of the risk event. Answer: C is incorrect. Transference
transfers the ownership of the risk event to a third party, usually through a contractual
agreement. Answer: D is incorrect. Enhance is a risk response that tries to increase the
probability and/or impact of the positive risk event.
Question 6
Which of the following terms refers to a mechanism which proves that the sender reallysent a particular message?
A. Confidentiality B. Non-repudiation C. Authentication D. Integrity
Answer: B
Explanation: Non-repudiation is a mechanism which proves that the sender really sent a
message. It provides an evidence of the identity of the senderand message integrity. It also
prevents a person from denying the submission or delivery of the message and the integrity
of its contents. Answer: C is incorrect. Authentication is a process of verifying the identity of
a person or network host. Answer: A is incorrect. Confidentiality ensures that no one can
read a message except the intended receiver. Answer: D is incorrect. Integrity assures the
receiver that the received message has not been altered in any way from the original.
Question 7
Which of the following are the important areas addressed by a software system's securitypolicy? Each correct answer represents a complete solution. Choose all that apply.
A. Identification and authentication B. Punctuality C. Data protection D. Accountability E. Scalability F. Access control
Answer: A,C,D,F
Explanation: The security policy of a software system addresses the following important
areas: Access control Data protection Confidentiality Integrity Identification and
authentication Communication security Accountability Answer: E and B are incorrect.
Scalability and punctuality are not addressed by a software system's security policy.
Question 8
Which of the following is a patch management utility that scans one or more computers on a network and alerts a user if any important Microsoft security patches are missing andalso provides links that enable those missing patches to be downloaded and installed?
A. MABS B. ASNB C. MBSA D. IDMS
Answer: C
Explanation: Microsoft Baseline Security Analyzer (MBSA) is a tool that includes a
graphical and command line interface that can perform local or remote scans of Windows
systems. It runs on computers running Windows 2000, Windows XP, or Windows Server
2003 operating system. MBSA scans for common security misconfigurations in Windows
NT 4.0, Windows 2000, Windows XP, Windows Server 2003, Internet Information Server
(IIS) 4.0 and above, SQL Server 7.0 and 2000, and Office 2000 and 2002. It also scans for
missing hot fixes in several Microsoft products, such as Windows 2000, Windows XP, SQL
Server etc. Answer: B, D, and A are incorrect. These are invalid options.
Question 9
John works as a professional Ethical Hacker. He has been assigned the project of testingthe security of www.we-are-secure.com. He finds that the We-are-secure server isvulnerable to attacks. As a countermeasure, he suggests that the Network Administratorshould remove the IPP printing capability from the server. He is suggesting this as acountermeasure against __________.
A. SNMP enumeration B. IIS buffer overflow C. NetBIOS NULL session D. DNS zone transfer
Answer: B
Explanation: Removing the IPP printing capability from a server is a good countermeasure
against an IIS buffer overflow attack. A Network Administrator should take the following
steps to prevent a Web server from IIS buffer overflow attacks: Conduct frequent scans for
server vulnerabilities. Install the upgrades of Microsoft service packs.
Implement effective firewalls. Apply URLScan and IISLockdown utilities. Remove the IPP
printing capability. Answer: D is incorrect. The following are the DNS zone transfer
countermeasures: Do not allow DNS zone transfer using the DNS property sheet: a.Open
DNS. b.Right-click a DNS zone and click Properties. c.On the Zone Transfer tab, clear the
Allow zone transfers check box. Configure the master DNS server to allow zone transfers
only from secondary DNS servers: a.Open DNS. b.Right-click a DNS zone and click
Properties. c.On the zone transfer tab, select the Allow zone transfers check box, and then
do one of the following: To allow zone transfers only to the DNS servers listed on the name
servers tab, click on the Only to the servers listed on the Name Server tab. To allow zone
transfers only to specific DNS servers, click Only to the following servers, and add the IP
address of one or more servers. Deny all unauthorized inbound connections to TCP port
53. Implement DNS keys and encrypted DNS payloads. Answer: A is incorrect. The
following are the countermeasures against SNMP enumeration: 1.Removing the SNMP
agent or disabling the SNMP service 2.Changing the default PUBLIC community name
when 'shutting off SNMP' is not an option 3.Implementing the Group Policy security option
called Additional restrictions for anonymous connections 4.Restricting access to NULL
session pipes and NULL session shares 5.Upgrading SNMP Version 1 with the latest
version 6.Implementing Access control list filtering to allow only access to the read-write
community from approved stations or subnets Answer: C is incorrect. NetBIOS NULL
session vulnerabilities are hard to prevent, especially if NetBIOS is needed as part of the
infrastructure. One or more of the following steps can be taken to limit NetBIOS NULL
session vulnerabilities: 1.Null sessions require access to the TCP 139 or TCP 445 port,
which can be disabled by a Network Administrator. 2.A Network Administrator can also
disable SMB services entirely on individual hosts by unbinding WINS Client TCP/IP from
the interface. 3.A Network Administrator can also restrict the anonymous user by editing
the registry values: a.Open regedit32, and go to HKLM\SYSTEM\CurrentControlSet\LSA.
b.Choose edit > add value. Value name: RestrictAnonymous Data Type: REG_WORD
Value: 2
Question 10
"Enhancing the Development Life Cycle to Produce Secure Software" summarizes thetools and practices that are helpful in producing secure software. What are these tools andpractices? Each correct answer represents a complete solution. Choose three.
A. Leverage attack patterns B. Compiler security checking and enforcement C. Tools to detect memory violations D. Safe software libraries E. Code for reuse and maintainability
Answer: B,C,D
Explanation: The tools and practices that are helpful in producing secure software are
summarized in the report "Enhancing the Development Life Cycle to Produce Secure
Software". The tools and practices are as follows: Compiler security checking and
Comments