CISSP Exam Preparation (Question 259)

(259) Ensuring the integrity of business information is the PRIMARY concern of

A. Encryption Security

B. Procedural Security.

C. Logical Security

D. On-line Security

Correct Answer: B

Explanation/Reference:

Procedures are looked at as the lowest level in the policy chain because they are closest to the computers and provide detailed steps for configuration and installation issues. They provide the steps to actually implement the statements in the policies, standards, and guidelines...Security procedures, standards,measures, practices, and policies cover a number of different subject areas. - Shon Harris All-in-one CISSP Certification Guide pg 44-45

- Idham Azhari

CISSP Exam Preparation (Question 258)

(258) Which one of the following is an important characteristic of an information security policy?

A. Identifies major functional areas of information.

B. Quantifies the effect of the loss of the information.

C. Requires the identification of information owners.

D. Lists applications that support the business function.

Correct Answer: A

Explanation/Reference:

Information security policies area high-level plans that describe the goals of the procedures. Policies are not guidelines or standards, nor are they procedures or controls. Policies describe security in general terms, not specifics. They provide the blueprints for an overall security program just as a specification defines your next product - Roberta Bragg CISSP Certification Training Guide (que) pg 206

- Idham Azhari

CISSP Exam Preparation (Question 257)

(257) A security policy would include all of the following EXCEPT

A. Background

B. Scope statement

C. Audit requirements

D. Enforcement

Correct Answer: B

Explanation/Reference:

None

- Idham Azhari

CISSP Exam Preparation (Question 256)

(256) All of the following are basic components of a security policy EXCEPT the

A. definition of the issue and statement of relevant terms.

B. statement of roles and responsibilities

C. statement of applicability and compliance requirements.

D. statement of performance of characteristics and requirements.

Correct Answer: D

Explanation/Reference:

Policies are considered the first and highest level of documentation, from which the lower level elements of standards, procedures, and guidelines flow. This order, however, does not mean that policies are more important than the lower elements. These higher- level policies, which are the more general policies andstatements, should be created first in the process for strategic reasons, and then the more tactical elements can follow.

- Idham Azhari

CISSP Exam Preparation (Question 255)

(255) The U.S. Uniform Computer Information Transactions Act (UCITA) is a:

A. Model act that is intended to apply uniform legislation to electronic 
credit transactions

B. Model act that is intended to apply uniform legislation to software 
licensing

C. Model act that addresses electronic transactions conducted by financial 
institutions

D. Model act that addresses digital signatures

Explanation:

The National Commissioners on Uniform State Laws (NCUSL) voted to approve the Uniform Computers Information Transactions Act (UCITA) on July 29, 1999. This legislation, which will have to be enacted state-by-state, will greatly affect libraries access to and use of software packages. It also will keep in place the current licensingpractices of software vendors. At the present time, shrink-wrap or click-wrap licenses limit rights that are normally granted under copyright law. Under Section 109 of the U.S. 1976 Copyright Act, the first sale provision permits the owner of a particular copy withoutthe authority of the copyright owner, to sell or otherwise dispose of the possession of that copy. However, the software manufacturers use the term license in their transactions. As opposed to the word sale, the term license denotes that the software manufacturers arepermitting users to use a copy of their softwarE . Thus, the software vendor still owns the softwarE . Until each state enacts the legislation, it is not clear if shrink-wrap licenses that restrict users rights under
copyright law are legally enforceablE . For clarification, shrink-wrap licenses physically accompany a disk while click-on and active clickwrap licenses are usually transmitted electronically. Sometimes, the term shrink-wrap is interpreted to mean both physical and electronic licenses to use softwarE . The focus of the UCITA legislation is not on the physical media, but on the information contained on the media.

- Idham Azhari

CISSP Exam Preparation (Question 249)

(249) Which of the following alternatives should NOT be used by law enforcement to gain access to a password?

A. Contacting the developer of the software for information to gain access to the computer or network through a back door

B. Compelling the suspect to provide the password

C. Data manipulation and trial procedures applied to the original version of the system hard disk

D. Using password cracker software

Explanation:

The original disk of a computer involved in a criminal investigation should not be used for any experimental purposes since data may be modified or destroyed. Any operations should be conducted on a copy of the system disk. However, the other answers are the preferred methods of gaining access to a password-protected system.
Interestingly, in answer b, there is legal precedent to order a suspect to provide the password of a computer that is in the custody of law enforcement.

- Idham Azhari

CISSP Exam Preparation (Question 248)

(248) Which is NOT a recommended way to dispose of unwanted used data media?

A. Copying new data over existing data on diskettes

B. Formatting diskettes seven or more times

C. Shredding paper reports by cleared personnel

D. Destroying CD-ROMs

Explanation:
The correct answer is copying new data over existing data on diskettes. While this method might overwrite the older files, if the new data file is smaller than the older data file, recoverable data might exist past the file end marker of the new file.

- Idham Azhari