Highmark- CISSP Initial Skill Set Evaluation
-
In order to have strong and effective network security in place the Certified Information Systems Security Professional (CISSP) will employ the use of both system and data access controls. This requires management and development of methodologies which ensure proper authentication, proper authorization and the identification and prevention of system attacks. Access control is defined as who has access to systems and what their permissions to the system are. Administrative, technical, and physical techniques assist in protecting data and under technical controls, which measure properly describes a PIV card?
-
An access control mechanism
-
An encryption device
-
A remote access authentication protocol
-
An access control list
-
About This Quiz
The 'Highmark- CISSP Initial Skill Set Evaluation' assesses foundational skills in network and information security. It evaluates understanding of access controls, authentication methods, and system security techniques, vital for aspiring CISSP professionals.
Quiz Preview
- 2.
In the use of logical access controls, biometric authentication is considered to be which of the following?
-
The strongest authentication available because of the rarity of similar human characteristics such as fingerprints.
-
The weakest form of authentication because it can be forged or replicated.
-
The strongest form of authentication because it uses two authentication requirements.
-
Not the strongest form of authentication because it is based on only one authentication requirement.
Correct Answer
A. Not the strongest form of authentication because it is based on only one authentication requirement.Explanation
Biometric authentication is not considered the strongest form of authentication because it is based on only one authentication requirement. While biometric characteristics such as fingerprints are unique to individuals, they can still be compromised or replicated. The strongest form of authentication typically involves the use of multiple factors, such as something the user knows (password), something the user has (smart card), and something the user is (biometric).Rate this question:
-
- 3.
Centralized access controls are used for authentication of remote users where the access control system maintains the users account information in a central location. From the choices available, which form of centralized access is LEAST reliable?
-
PAP
-
LDAP
-
RAS
-
RADIUS
Correct Answer
A. RADIUSExplanation
RADIUS (Remote Authentication Dial-In User Service) is the least reliable form of centralized access control among the given options. RADIUS is a protocol that allows remote users to authenticate and gain access to a network. However, it has some limitations that make it less reliable compared to the other options. For example, RADIUS does not support strong encryption, making it vulnerable to security breaches. Additionally, RADIUS has limited scalability and can struggle to handle high volumes of authentication requests, leading to potential performance issues. Therefore, when considering reliability, RADIUS is the least preferable option.Rate this question:
-
- 4.
The operating system performs many security functions on a computer in order to facilitate applications. In which function does the operating system prevent a process from tampering with other processes?
-
Access control
-
Authentication
-
Network communication
-
Process isolation
Correct Answer
A. Process isolationExplanation
The operating system prevents a process from tampering with other processes through process isolation. This function ensures that each process runs in its own separate memory space, preventing it from accessing or modifying the memory of other processes. By isolating processes, the operating system enhances security by preventing unauthorized access and interference between processes, thereby safeguarding the integrity and stability of the system.Rate this question:
-
- 5.
Service level agreements determine how and when work functions will be performed in terms of software applications and their support. Which one of these choices would not be considered a service level agreement?
-
Data storage requirements
-
Physical security
-
Number of concurrent users
-
Service desk response
Correct Answer
A. Physical securityExplanation
Physical security would not be considered a service level agreement because it does not pertain to the performance or support of software applications. Service level agreements typically focus on measurable metrics such as response times, availability, and performance of the software, whereas physical security relates to the protection of physical assets and facilities.Rate this question:
-
- 6.
Rootkit attacks are designed to hide within the targeted system in order to hide from detection. Rootkits perform malicious acts of destroying, altering, editing, and stealing of data. A rootkit that acts as a virtual machine between the hardware of a computer and the operating system is a what?
-
Hardware
-
Kernel
-
Hypervisor
-
Library
Correct Answer
A. HypervisorExplanation
A rootkit that acts as a virtual machine between the hardware of a computer and the operating system is called a hypervisor. Hypervisors are designed to create and manage virtual machines, allowing multiple operating systems to run on a single physical machine. In the context of a rootkit attack, a hypervisor rootkit would hide itself by running as a layer between the hardware and the operating system, making it difficult to detect and remove. This allows the rootkit to perform malicious activities such as data destruction, alteration, editing, and theft without being detected by traditional security measures.Rate this question:
-
- 7.
Business continuity planning includes all of the following steps EXCEPT?
-
Continuity planning
-
Application acquisition
-
Approval and implementation
-
Business impact assessment
Correct Answer
A. Application acquisition -
- 8.
What is the correct formula for the annualized loss expectancy (ALE) which is the financial loss a business expects to incur as a result of a risk harming an asset over the course of a year?
-
ALE=AV x EF
-
ALE=SLE + EF
-
ALE=SLE x ARO
-
ALE=EF-SLE
Correct Answer
A. ALE=SLE x AROExplanation
The correct formula for the annualized loss expectancy (ALE) is ALE = SLE x ARO. ALE stands for the financial loss a business expects to incur as a result of a risk harming an asset over the course of a year. SLE represents the single loss expectancy, which is the amount of loss expected from a single occurrence of the risk. ARO stands for the annual rate of occurrence, which is the estimated number of times the risk is expected to occur in a year. Multiplying the SLE by the ARO gives the ALE, which represents the expected financial loss over the course of a year.Rate this question:
-
- 9.
When designing and deploying business continuity plans which resource should be protected first?
-
Physical buildings
-
People
-
Infrastructure
-
Financial assets
Correct Answer
A. PeopleExplanation
When designing and deploying business continuity plans, the resource that should be protected first is people. This is because employees are the most valuable asset of any organization and their safety and well-being should be the top priority. Without people, the physical buildings, infrastructure, and financial assets are meaningless. Therefore, ensuring the safety and security of employees is crucial for the successful implementation of business continuity plans.Rate this question:
-
- 10.
Steganography is the concealing of information within computer files most often large files of data or images. In steganography the information that is to be concealed and transmitted is the?
-
Carrier
-
Payload
-
Stegomedium
-
Least significant bit
Correct Answer
A. PayloadExplanation
In steganography, the information that is to be concealed and transmitted is referred to as the "payload". The payload is the actual data or message that is hidden within the carrier file. The carrier file can be any type of computer file, such as an image or a large file of data, and it serves as a cover for the hidden payload. The goal of steganography is to hide the existence of the payload within the carrier file, making it difficult for anyone to detect the hidden information.Rate this question:
-
- 11.
Which of the following cryptography terms would BEST describe a scenario where a symmetric key encrypts data and an asymmetric key encrypts the symmetric key?
-
Lucifer
-
Hybrid cryptography
-
Digital envelope
-
Session keys
Correct Answer
A. Hybrid cryptographyExplanation
Hybrid cryptography is the best term to describe a scenario where a symmetric key encrypts data and an asymmetric key encrypts the symmetric key. In hybrid cryptography, a combination of symmetric and asymmetric encryption techniques is used to achieve both efficiency and security. The symmetric key is used for encrypting the actual data, which is faster and more efficient, while the asymmetric key is used to encrypt the symmetric key, providing an added layer of security. This approach combines the benefits of both encryption methods, ensuring secure communication.Rate this question:
-
- 12.
The NIST developed federal government standards beginning in 1991 called digital signature standards. Of the DSS standards RSA and DSA are most commonly used. When two different messages are computed by the same algorithm and the same message digest value results this is what?
-
CMAC
-
Knapsack algorithm
-
Collision
-
One-way hatch
Correct Answer
A. CollisionExplanation
When two different messages are computed by the same algorithm and the same message digest value results, it is known as a collision. A collision occurs when different inputs produce the same output in a hash function. In the context of digital signature standards, collisions are undesirable as they can lead to security vulnerabilities. It is important for hash functions to minimize the likelihood of collisions to ensure the integrity and authenticity of digital signatures.Rate this question:
-
- 13.
The Certified Information Systems Security Professional must understand the basic principles which compose the C-I-A triad as well as understanding defense-in-depth and prevention of failure points. Which term is not included in the C-I-A triad?
-
Confidentiality
-
Integrity
-
Availability
-
Access
Correct Answer
A. AccessExplanation
The term "Access" is not included in the C-I-A triad. The C-I-A triad refers to the three fundamental principles of information security: Confidentiality, Integrity, and Availability. Access, on the other hand, refers to the ability to interact with or make use of something, such as gaining entry to a system or resource. While access control is an important aspect of information security, it is not one of the core principles represented by the C-I-A triad.Rate this question:
-
- 14.
"Defense in depth" is an information security strategy which is based on multiple layers of defense. Which of these parts is not a component of "Defense in depth"?
-
Vendor software solutions
-
Security management principles
-
Security technologies
-
Physical plant security
Correct Answer
A. Physical plant securityExplanation
"Defense in depth" is an information security strategy that involves implementing multiple layers of defense to protect against potential threats. This includes various components such as vendor software solutions, security management principles, and security technologies. However, physical plant security, which refers to the physical protection of the facility where the information is stored, is not considered a component of "Defense in depth."Rate this question:
-
- 15.
Managing risk is a key part of information security. The definition of risk includes the threat to and vulnerability of an asset. Which risk management concept involves the absence of a safeguard to protect against a threat?
-
Threat
-
Asset
-
Vulnerability
-
Risk treatment
Correct Answer
A. VulnerabilityExplanation
Vulnerability refers to the absence of a safeguard to protect against a threat. In the context of risk management, a vulnerability represents a weakness or flaw in the security measures of an asset. It indicates that there is no protection mechanism in place to mitigate or prevent potential threats from exploiting the asset. By identifying vulnerabilities, organizations can prioritize and implement appropriate safeguards to minimize the risk associated with potential threats.Rate this question:
-
- 16.
Which act or law provides for the "prudent man rule"?
-
Government Information Security Reform Act of 2000
-
Computer Security Act of 1987
-
Federal sentencing guidelines of 1991
-
Computer Fraud and Abuse Act of 1984
Correct Answer
A. Federal sentencing guidelines of 1991Explanation
The "prudent man rule" is provided for in the Federal sentencing guidelines of 1991. This rule requires that individuals in positions of authority exercise reasonable care, skill, and caution when making decisions on behalf of others. It is particularly relevant in the context of financial management and investment decisions, where fiduciaries are expected to act in the best interests of their clients or beneficiaries. The Federal sentencing guidelines of 1991 outline the principles and standards for imposing criminal sentences in the United States federal courts, including considerations for white-collar crimes such as fraud and embezzlement.Rate this question:
-
- 17.
Intangible assets such as a trademarked name is considered intellectual property. Which of the following terms is not a form of intellectual property?
-
Business plan template
-
Copyrights
-
Trademarks
-
Trade secrets
Correct Answer
A. Business plan templateExplanation
A business plan template is not a form of intellectual property because it is a tool or framework used to create a business plan, which is a document outlining a company's goals and strategies. Intellectual property refers to legal rights that protect creations of the mind, such as trademarks, copyrights, and trade secrets. These forms of intellectual property provide exclusive rights and protections for original works, inventions, and confidential information. However, a business plan template itself is not an original creation or invention, but rather a tool used to organize and present information in a business plan.Rate this question:
-
- 18.
Which of the following privacy laws prevents internet service providers from making unauthorized disclosures of the content of email and voicemail?
-
The Electronic Communications Privacy Act of 1986
-
The Communications Assistance for Law Enforcement Act of 1994
-
The Economical and Protection of Proprietary Information Act of 1996
-
The Gramm-Leach-Bliley Act of 1999
Correct Answer
A. The Electronic Communications Privacy Act of 1986Explanation
The correct answer is The Electronic Communications Privacy Act of 1986. This law, also known as ECPA, protects the privacy of electronic communications, including email and voicemail. It prohibits internet service providers from making unauthorized disclosures of the content of these communications. ECPA sets guidelines for government surveillance and requires law enforcement agencies to obtain a warrant in order to access the content of electronic communications. It was enacted to update and strengthen privacy protections in response to advancements in technology and the increasing use of electronic communications.Rate this question:
-
- 19.
In the management of security operations the "need to know principle" requires that users are granted access only to the data needed to perform their assigned tasks. Which of the following is NOT a component of the "need to know principle"?
-
Keeps secret information secret
-
Is associated with security clearances
-
Prevents inadvertent access.
-
Ensures subjects receive privileges
Correct Answer
A. Ensures subjects receive privilegesExplanation
The "need to know principle" is a concept in security operations that ensures users are only given access to the data necessary for their assigned tasks. It focuses on granting access based on a user's specific needs, rather than providing unrestricted access to all information. The other options mentioned in the question - keeping secret information secret, being associated with security clearances, and preventing inadvertent access - are all components of the "need to know principle" as they contribute to the restriction and control of data access. However, ensuring subjects receive privileges is not a component of this principle, as it does not pertain to the restriction of access based on necessity.Rate this question:
-
- 20.
Patch management involves the development of code which improves performance, corrects a bug, or prevents a vulnerability. Which step in the patch management program would include a change management process?
-
Evaluation of patches
-
Approval of patches
-
Testing of patches
-
Deployment of patches.
Correct Answer
A. Approval of patchesExplanation
The step in the patch management program that would include a change management process is the approval of patches. This is because before any patch can be deployed, it needs to go through a thorough evaluation and approval process to ensure that it meets the necessary criteria and does not introduce any new issues. The change management process helps in assessing the impact of the patch on the overall system and ensures that it aligns with the organization's policies and procedures.Rate this question:
-
- 21.
What is the most important aspect in security operations for the separation of duties?
-
Prevents one person from retaining business trade secrets.
-
Ensures a platform for increased job responsibility.
-
It prevents one person from having total control of a function or system.
-
Determines the level of security clearance.
Correct Answer
A. It prevents one person from having total control of a function or system.Explanation
The most important aspect in security operations for the separation of duties is to prevent one person from having total control of a function or system. This is crucial because it reduces the risk of fraud, errors, and abuse. By distributing responsibilities among multiple individuals, it ensures that no single person can manipulate or misuse the system for personal gain. This helps to maintain integrity, confidentiality, and availability of critical resources within an organization's security framework.Rate this question:
-
- 22.
The process of developing a secure facility plan is called the critical path analysis. The critical path analysis is used to systematically identify critical operations and processes. Three of the following factors are most suited for the analysis of a server room. Which would not be a part of a critical path analysis?
-
Flood plain level
-
Cost of IT equipment upgrade
-
Temperature control
-
Electrical reliability
Correct Answer
A. Cost of IT equipment upgradeExplanation
The critical path analysis is used to identify critical operations and processes that are essential for the functioning of a secure facility. Factors such as flood plain level, temperature control, and electrical reliability are all crucial for the security and operation of a server room. However, the cost of IT equipment upgrade is not directly related to the critical path analysis. While it may be an important consideration for the overall facility plan, it does not specifically pertain to the identification of critical operations and processes.Rate this question:
-
- 23.
Physical security controls are grouped into three categories of physical, technical, and administrative. When designing the physical security environment four basic principals are used.
-
Detection
-
Deterrence
-
Distinguish
-
Denial
Correct Answer
A. DistinguishExplanation
The principle of "distinguish" in designing the physical security environment refers to the ability to differentiate between authorized individuals and unauthorized individuals. This can be achieved through various means such as identification badges, access control systems, or biometric authentication. By implementing measures that distinguish between authorized and unauthorized individuals, organizations can ensure that only those with proper credentials or permissions are granted access to protected areas or resources. This helps to enhance the overall security of the physical environment by preventing unauthorized individuals from gaining entry.Rate this question:
-
- 24.
Considering physical access controls which is the most prevalent form of perimeter security?
-
Lighting
-
Fencing
-
Security personnel
-
Video monitoring
Correct Answer
A. LightingExplanation
Lighting is the most prevalent form of perimeter security because it helps to deter potential intruders by illuminating the area around the perimeter. Well-lit areas make it difficult for individuals to hide or approach undetected, increasing the chances of being noticed by security personnel or surveillance cameras. Adequate lighting also enhances the effectiveness of other security measures, such as video monitoring, by providing clear visibility. Additionally, lighting can create a sense of safety and discourage criminal activities, making it an essential component of physical access controls.Rate this question:
-
- 25.
Protection mechanisms for a computer security system may include protection rings which organize code and applications under the operating systems control. Using the four ring model of protection ring which level has the highest privilege level?
-
Ring 0
-
Ring 3
-
Ring 1
-
Ring 4
Correct Answer
A. Ring 0Explanation
In computer security systems, protection rings are used to organize code and applications under the control of the operating system. The four ring model consists of Ring 0, Ring 1, Ring 2, and Ring 3. The level with the highest privilege level is Ring 0. This means that code and applications running at Ring 0 have the highest level of access and control over the system.Rate this question:
-
- 26.
Which security mode provides access where control is based on whether the users security clearance level dominates the object's sensitivity level?
-
Compartmental mode
-
System High mode
-
Multilevel mode
-
Dedicated mode
Correct Answer
A. Multilevel modeExplanation
Multilevel mode provides access based on the dominance of the user's security clearance level over the object's sensitivity level. This means that a user with a higher security clearance can access objects with lower sensitivity levels, but a user with a lower security clearance cannot access objects with higher sensitivity levels. This mode allows for controlled access to information based on the security needs of the users and the sensitivity of the objects.Rate this question:
-
- 27.
When using a redundant server system to prevent a single point failure, which redundant server deploys two or more servers to share workload of applications?
-
Database shadowing
-
Clusters
-
Electronic vaulting
-
Server mirroring
Correct Answer
A. ClustersExplanation
Clusters are a type of redundant server system that deploys two or more servers to share the workload of applications. This helps prevent a single point of failure by distributing the workload across multiple servers. By dividing the workload, clusters ensure that if one server fails, the other servers in the cluster can continue to handle the workload, maintaining the availability and reliability of the applications.Rate this question:
-
- 28.
The MAC sub layer operates between the logical link control sub layer and the physical layer. Which of the following is NOT a function of the MAC sub layer?
-
Identifies hardware device addresses
-
Encrypts LLC sub layers
-
Performs error control
-
Controls media access
Correct Answer
A. Encrypts LLC sub layersExplanation
The MAC sub layer is responsible for identifying hardware device addresses, performing error control, and controlling media access. However, it does not encrypt LLC sub layers. Encryption is typically handled by higher layers of the network protocol stack, such as the network or transport layer.Rate this question:
-
- 29.
Virtual private networks provide secure tunnels over public networks. Under level 2 tunneling protocol (L2TP) secure VPN connections are created for client server connections. L2TP will address all of the following requirements for the user EXCEPT?
-
Local Addressing
-
Authorization
-
Limited speed requirements
-
Authentication
Correct Answer
A. Limited speed requirementsExplanation
L2TP will address local addressing, authorization, and authentication requirements for the user. However, it does not specifically address limited speed requirements. L2TP is primarily focused on providing secure VPN connections rather than optimizing network speed.Rate this question:
-
- 30.
Telephone communications systems are susceptible to security breaches as networks. Which of these choices is NOT a corporate telecommunications switch to be protected with security measures?
-
PBX
-
POTS
-
VoIP
-
TeleNet iX
Correct Answer
A. TeleNet iXExplanation
TeleNet iX is not a corporate telecommunications switch that needs to be protected with security measures. The other options, PBX, POTS, and VoIP, are all types of corporate telecommunications switches that are susceptible to security breaches and require security measures to protect them.Rate this question:
-
- 31.
Your Job Title:
Correct Answer
N/A - 32.
Years of Overall Professional Experience:
Correct Answer
N/A - 33.
Years in Current Job Title:
Correct Answer
N/A - 34.
On a scale of 1-5 with 5 being the highest, rate your expertise level in the CISSP Domain of Access Control.
-
1
-
2
-
3
-
4
-
5
Explanation
The given correct answer is 1. This indicates that the person has the lowest level of expertise in the CISSP Domain of Access Control. A rating of 1 suggests that the person has very limited knowledge and understanding of access control concepts and practices. They may have little to no experience in implementing access control measures or managing access to systems and resources.Rate this question:
-
- 35.
On a scale of 1-5 with 5 being the highest, rate your expertise level in the CISSP Domain of Application Security.
-
1
-
2
-
3
-
4
-
5
Explanation
The given correct answer is 5. This indicates that the person has the highest level of expertise in the CISSP Domain of Application Security.Rate this question:
-
- 36.
On a scale of 1-5 with 5 being the highest, rate your expertise level in the CISSP Domain of Business Continuity.
-
1
-
2
-
3
-
4
-
5
Explanation
This question is asking the respondent to rate their expertise level in the CISSP Domain of Business Continuity on a scale of 1-5, with 5 being the highest. The correct answer is "3". This indicates that the respondent has a moderate level of expertise in the CISSP Domain of Business Continuity.Rate this question:
-
- 37.
On a scale of 1-5 with 5 being the highest, rate your expertise level in the CISSP Domain of Cryptography.
-
1
-
2
-
3
-
4
-
5
Explanation
The given correct answer is "1". This indicates that the individual has the lowest level of expertise in the CISSP Domain of Cryptography. A rating of 1 suggests that the person has limited knowledge and understanding of the concepts and principles of cryptography. They may have a basic understanding of encryption algorithms, key management, and cryptographic protocols, but their expertise in this domain is minimal.Rate this question:
-
- 38.
On a scale of 1-5 with 5 being the highest, rate your expertise level in the CISSP Domain of Information Security & Risk Management.
-
1
-
2
-
3
-
4
-
5
Explanation
This question asks the respondent to rate their expertise level in the CISSP Domain of Information Security & Risk Management on a scale of 1-5, with 5 being the highest. The correct answer is 3. This means that the respondent considers themselves to have a moderate level of expertise in this domain.Rate this question:
-
- 39.
On a scale of 1-5 with 5 being the highest, rate your expertise level in the CISSP Domain of Legal Regulations, Compliance, & Investigations.
-
1
-
2
-
3
-
4
-
5
Explanation
The question asks the respondent to rate their expertise level in the CISSP Domain of Legal Regulations, Compliance, & Investigations on a scale of 1-5. The correct answer is "3". This indicates that the respondent has a moderate level of expertise in this domain. They have some knowledge and understanding of legal regulations, compliance, and investigations, but may still have room for improvement and further learning in this area.Rate this question:
-
- 40.
On a scale of 1-5 with 5 being the highest, rate your expertise level in the CISSP Domain of Physical (Environmental) Security.
-
1
-
2
-
3
-
4
-
5
Explanation
The question asks the respondent to rate their expertise level in the CISSP Domain of Physical (Environmental) Security on a scale of 1-5, with 5 being the highest. The correct answer is "1". This implies that the respondent has the lowest level of expertise in this domain.Rate this question:
-
- 41.
On a scale of 1-5 with 5 being the highest, rate your expertise level in the CISSP Domain of Security Architecture & Design.
-
1
-
2
-
3
-
4
-
5
Explanation
This question is asking the respondent to rate their expertise level in the CISSP Domain of Security Architecture & Design on a scale of 1-5, with 5 being the highest. The correct answer is "5" as it indicates that the respondent has the highest level of expertise in this domain.Rate this question:
-
- 42.
On a scale of 1-5 with 5 being the highest, rate your expertise level in the CISSP Domain of Telecommunications & Network Security.
-
1
-
2
-
3
-
4
-
5
Explanation
The given correct answer is "1". This indicates that the person has the lowest expertise level in the CISSP Domain of Telecommunications & Network Security.Rate this question:
-
- 43.
Years at Highmark
Quiz Review Timeline (Updated): Jun 18, 2024 +
Our quizzes are rigorously reviewed, monitored and continuously updated by our expert board to maintain accuracy, relevance, and timeliness.
-
Current Version
-
Jun 18, 2024Quiz Edited by
ProProfs Editorial Team -
Nov 20, 2013Quiz Created by
Infoseci
Back to top