Which of the following phases of the ISSE model is used to determine why the system needs to be built and what information needs to be protected

Discover information protection needs

Develop detailed security design

Define system security requirements

Discover information protection needs

Define system security architecture

The Concept of Operations (CONOPS) is a document describing the characteristics of a proposed system from the viewpoint of an individual who will use that system. Which of the following points are included in CONOPS Each correct answer represents a complete solution. Choose all that apply.

Strategies, tactics, policies, and constraints affecting the system

Organizations, activities, and interactions among participants and stakeholders

Clear statement of responsibilities and authorities delegated

Statement of the goals and objectives of the system

Strategies, tactics, policies, and constraints affecting the system

Organizations, activities, and interactions among participants and stakeholders

Statement of the structure of the system

Clear statement of responsibilities and authorities delegated

Statement of the goals and objectives of the system

Which of the following DoD policies establishes IA controls for information systems according to the Mission Assurance Categories (MAC) and confidentiality levels

DoD 8500.2 Information Assurance Implementation

DoD 8500.1 Information Assurance (IA)

DoD 8500.2 Information Assurance Implementation

Which of the following tasks describes the processes required to ensure that the project includes all the work required, and only the work required, to complete the project successfully

Identify Roles and Responsibilities

Identify Resources and Availability

Which of the following security controls works as the totality of protection mechanisms within a computer system, including hardware, firmware, and software, the combination of which is responsible for enforcing a security policy

Common data security architecture (CDSA)

Internet Protocol Security (IPSec)

Application program interface (API)

A security policy is an overall general statement produced by senior management that dictates what role security plays within the organization. Which of the following are required to be addressed in a well designed policy Each correct answer represents a part of the solution. Choose all that apply.

Who is expected to comply with the policy

Where is the vulnerability, threat, or risk

Who is expected to comply with the policy

Where is the vulnerability, threat, or risk

Who is expected to exploit the vulnerability

Which of the following cooperative programs carried out by NIST speed ups the development of modern technologies for broad, national benefit by co-funding research and development partnerships with the private sector

Baldrige National Quality Program

Manufacturing Extension Partnership

The DoD 8500 policy series represents the Department's information assurance strategy. Which of the following objectives are defined by the DoD 8500 seriesEach correct answer represents a complete solution. Choose all that apply.

Providing command and control and situational awareness

Providing IA Certification and Accreditation

Providing command and control and situational awareness

Which of the following characteristics are described by the DIAP Information Readiness Assessment function Each correct answer represents a complete solution. Choose all that apply.

It performs vulnerabilitythreat analysis assessment.

It provides data needed to accurately assess IA readiness.

It identifies and generates IA requirements.

It performs vulnerabilitythreat analysis assessment.

It provides for entry and storage of individual system data.

It provides data needed to accurately assess IA readiness.

It identifies and generates IA requirements.

The functional analysis process is used for translating system requirements into detailed function criteria. Which of the following are the elements of functional analysis process Each correct answer represents a complete solution. Choose all that apply.

Model possible overall system behaviors that are needed to achieve the system requirements.

Develop concepts and alternatives that are not technology or component bound.

Use a top-down with some bottom-up approach verification.

Model possible overall system behaviors that are needed to achieve the system requirements.

Develop concepts and alternatives that are not technology or component bound.

Decompose functional requirements into discrete tasks or activities, the focus is still on technology not functions or components.

Use a top-down with some bottom-up approach verification.

Which of the following acts is endorsed to provide a clear statement of the proscribed activity concerning computers to the law enforcement community, those who own and operate computers, and those tempted to commit crimes by unauthorized access to computers

Government Information Security Reform Act (GISRA)

Federal Information Security Management Act (FISMA)

In which of the following phases of the interconnection life cycle as defined by NIST SP 800-47 does the participating organizations perform the following tasks Perform preliminary activities. Examine all relevant technical, security and administrative issues. Form an agreement governing the management, operation, and use of the interconnection.

Establishing the interconnection

Disconnecting the interconnection

Maintaining the interconnection

Which of the following terms describes the security of an information system against unauthorized access to or modification of information, whether in storage, processing, or transit, and against the denial of service to authorized users or the provision of service to unauthorized users

Information systems security (InfoSec)

Information Systems Security Engineering (ISSE)

Information Protection Policy (IPP)

Information systems security (InfoSec)

Your project team has identified a project risk that must be responded to. The risk has been recorded in the risk register and the project team has been discussing potential risk responses for the risk event. The event is not likely to happen for several months but the probability of the event is high. Which one of the following is a valid response to the identified risk event

Technical performance measurement

ISC CISSP-ISSEP Practice Test 4 - Free Online Exam Prep & Questions

Which of the following is a temporary approval to operate based on an assessment of the implementation status of the assigned IA Controls

IATO

DATO

ATO

IATT

Comment (0)

ISC CISSP-ISSEP Practice Test 4

Question

ISC CISSP-ISSEP Practice Tests

Practice Tests