#Wentz QOTD

[wentzwu]

CISSP PRACTICE QUESTIONS – 20230327

According to NIST SP 800-30 R1, “assessing risk requires the careful analysis of threat and vulnerability information to determine the extent to which circumstances or events could adversely impact an organization and the likelihood that such circumstances or events will occur.” Which of the following should be determined first before conducting a risk assessment? (Wentz QOTD)A. Risk assessment…

View On WordPress

[tnbtheories]

Momentos.

#stay positive #positive #positivity #positive quotes #quote #quotes #qotd #fallout boy #fall out boy #pete wentz #tattoos #mindset #yoga #consciousness #acceptance #health #healthy #yogi #life

[wentzwu]

CISSP PRACTICE QUESTIONS – 20230326

You are conducting a risk assessment based on NIST SP 800-30 R1, in which adversarial threat events are expressed as tactics, techniques, and procedures (TTPs). Which of the following risk factors best describes an adversarial threat event? (Wentz QOTD)A. Fire at the primary facilityB. Compliance with technical standardsC. Perform network sniffing of exposed networksD. Inability to perform…

View On WordPress

[wentzwu]

CISSP PRACTICE QUESTIONS – 20230325

According to NIST SP 800-30 R1, risk models define the risk factors to be assessed and the relationships among those factors. Risk factors are characteristics used in risk models as inputs to determining levels of risk in risk assessments. Which risk factor is not mentioned in the NIST generic risk model? (Wentz QOTD)A. Security postureB. Predisposing conditionsC. Likelihood of the success of a…

View On WordPress

[wentzwu]

CISSP PRACTICE QUESTIONS – 20230324

The Authorizations to Operate (ATO) for information systems is granted after controls assessment and system authorization as a formal decision for the management to accept the residual risk. To support continuous authorization, which of the following tasks should be implemented first? (Wentz QOTD)A. Automation for enforcement of policies and controlsB. Continuous integration and deliveryC.…

View On WordPress

[wentzwu]

CISSP PRACTICE QUESTIONS – 20230323

You are developing an intelligent agent as software to identify phishing emails. To develop, select, and optimize the model, a data set containing thousands of emails, either normal or phishing, is used for training, validation, and testing. Which of the following types of learning best describes the process? (Wentz QOTD)A. Supervised learning B. Unsupervised learningC. Reinforcement learningD.…

View On WordPress

[wentzwu]

CISSP PRACTICE QUESTIONS – 20230322

You are applying scoping considerations and tailoring security controls based on a baseline. Which of the following should be done first? (Wentz QOTD)A. Add controls based on risk assessment B. Determine asset valueC. Assign asset ownersD. Identify asset inventory Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong…

View On WordPress

[wentzwu]

CISSP PRACTICE QUESTIONS – 20230321

Which of the following best describes the purpose of security controls in terms of ISO 31000? (Wentz QOTD)A. To lower the likelihood or possibility of risk B. To reduce the adverse impact of threatsC. To modify the effect of uncertainty on objectivesD. To mitigate the threats Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or…

View On WordPress

[wentzwu]

CISSP PRACTICE QUESTIONS – 20230320

Key exchange is an inherent problem of symmetric ciphers. Which of the following is commonly considered the best solution in TLS nowadays? (Wentz QOTD)A. DHB. RSAC. ECDHD. ECDHE Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications. (more…) “”

View On WordPress

[wentzwu]

CISSP PRACTICE QUESTIONS – 20230319

In the cipher block chaining (CBC) mode of operation, the plaintext of the first block is XORed with the initialization vector (IV) and serves as the input of a block cipher. Which of the following best describes the purpose of the binary operation of plaintext and IV? (Wentz QOTD)A. ConfusionB. DiffusionC. PermutationD. Substitution Kindly be reminded that the suggested answer is for your…

View On WordPress

[wentzwu]

CISSP PRACTICE QUESTIONS – 20230318

Which of the following cryptographic algorithms is considered quantum-resistant? (Wentz QOTD)A. RSAB. ECCC. AESD. ECDH Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications. (more…) “”

View On WordPress

[wentzwu]

CISSP PRACTICE QUESTIONS – 20230317

Security Content Automation Protocol (SCAP) is “a suite of specifications that standardize the format and nomenclature by which software flaw and security configuration information is communicated, both to machines and humans.” Which of the following is a member of SCAP component specifications? (Wentz QOTD)A. Key risk indicator (KRI)B. Non-compliant itemsC. Management reviewD. Common…

View On WordPress

[wentzwu]

CISSP PRACTICE QUESTIONS – 20230316

System security requirements are those system requirements that have security relevance. Which of the following is not a typical type of security requirement in system security engineering? (Wentz QOTD)A. Security functional requirementB. Security nonfunctional requirement.C. Security control requirementD. Security assurance requirement Kindly be reminded that the suggested answer is for your…

View On WordPress

[wentzwu]

CISSP PRACTICE QUESTIONS – 20230315

Which of the following statements about identity management (IdM) is correct? (Wentz QOTD)A. An identity is a single attribute used to identify an entity uniquely.B. Accounts persisted in a directory are technical means representing entities.C. X.500 is derived from the Lightweight Directory Access Protocol (LDAP).D. Biometrics is more secure than passphrase in a single-factor authentication…

View On WordPress

[wentzwu]

CISSP PRACTICE QUESTIONS – 20230314

Policies, standards, procedures, and guidelines are prominent governance elements. For example, NIST Special Publications 800-53 series are guidelines aligned with the Federal Information Processing Standards 200 (FIPS 200). Which family of the following security requirements is specified in FIPS 200? (Wentz QOTD)A. Program ManagementB. PII Processing and TransparencyC. Supply Chain Risk…

View On WordPress

[wentzwu]

CISSP PRACTICE QUESTIONS – 20230313

Your company plans to purchase a computer system that shall provide trustworthy security functionality. Which of the following is the best standard to be considered? (Wentz QOTD)A. ISO/IEC 15408B. TCSECC. FIPS 140D. PCI DSS Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning…

View On WordPress