What is the first step of the Business Impact Assessment process?

12. D. In multilevel security mode, some users do not have a valid security clearance for all infor- mation processed by the system. For more information, please see Chapter 11.

13. B. ITSEC was developed in Europe for evaluating systems. Although TCSEC also called the

Orange Book would satisfy the evaluation criteria, only ITSEC evaluates functionality and assurance separately. For more information, please see Chapter 12. 14. B. The SYN packet is first sent from the initiating host to the destination host. The destination host then responds with a SYNACK packet. The initiating host sends an ACK packet and the connection is then established. For more information, please see Chapter 8.

15. B. One of the requirements of change management is that all changes must be capable of being

rolled back. For more information, please see Chapter 5. 16. C. Penetration testing is the attempt to bypass security controls to test overall system security. For more information, please see Chapter 14.

17. A. Network hardware devices, including routers, function at layer 3, the Network layer. For

more information, please see Chapter 3. 18. B. Not all instances of DoS are the result of a malicious attack. Errors in coding OSs, services, and applications have resulted in DoS conditions. Some examples of this include a process failing to release control of the CPU or a service consuming system resources out of proportion to the service requests it is handling. Social engineering and sniffing are typically not considered DoS attacks. For more information, please see Chapter 2.

19. C. Examples of detective controls are audit trails, logs, CCTV, intrusion detection systems,

antivirus software, penetration testing, password crackers, performance monitoring, and CRCs. For more information, please see Chapter 13.

20. B. Parameter checking is used to prevent the possibility of buffer overflow attacks. For more

information, please see Chapter 8.

21. B. Multiprocessing computers use more than one processor, in either a symmetric multipro-

cessing SMP or massively parallel processing MPP scheme. For more information, please see Chapter 11. 22. D. Differential backups store all files that have been modified since the time of the most recent full or incremental backup. For more information, please see Chapter 16.

23. C. The USA Patriot Act granted broad new powers to law enforcement, including the solicita-

tion of voluntary ISP cooperation. For more information, please see Chapter 17.

24. D. Scanning incidents are generally reconnaissance attacks. The real damage to a system comes

in the subsequent attacks, so you may have some time to react if you detect the scanning attack early. For more information, please see Chapter 18.

25. A. Auditing is a required factor to sustain and enforce accountability. For more information,

please see Chapter 14. 26. D. Dynamic packet-filtering firewalls enable real-time modification of the filtering rules based on traffic content. For more information, please see Chapter 3. Chapter 1 Accountability and Access Control THE CISSP EXAM TOPICS COVERED IN THIS CHAPTER INCLUDE: Accountability Access Control Techniques Access Control Administration Identification and Authentication Techniques Access Control Methodologies and Implementation