Online Access Free ISC.CISSP.v2021-08-21.q483 Practice Test (Page 75)

CISSP Exam Question 366

Which of the following is an IP address that is private (i.e. reserved for internal networks, and not a valid address to use on the Internet)?

A.192.168.42.5

B.192.166.42.5

C.192.175.42.5

D.192.1.42.5

CISSP Exam Question 367

A manufacturing organization wants to establish a Federated Identity Management (FIM) system with its 20 different supplier companies. Which of the following is the BEST solution for the manufacturing organization?

A.Trusted third-party certification

B.Lightweight Directory Access Protocol (LDAP)

C.Security Assertion Markup language (SAML)

D.Cross-certification

CISSP Exam Question 368

Which of the following questions will be addressed through the use of a Privacy Impact Assessment (PIA)?

A.How the information is to be maintained

B.Why the information is to be collected

C.What information is to be destroyed

D.Where the information is to be stored

CISSP Exam Question 369

Which Orange book security rating is the FIRST to be concerned with covert channels?

A.A1

B.B3

C.B2

D.B1

Correct Answer: C

This class ("Structured Protection") requires more stringent authentication mechanisms and well-defined interfaces between layers. Subjects and devices require labels and the system must not allow covert channels.
A1 is incorrect. A1 is also called "Verified Design" and requires formal verification of the design
and specifications.
B3 is incorrect. B3 is also called "Security Domains" and imposes more granularity in each
protection mechanism.
B1 is incorrect. B1 is also called "Labeled Security" and each data object must have a
classification label and each subject a clearance label. On each access attempt, the classification
and clearance are checked to verify that the access is permissible.
EXAM TIP:
The CBK only discusses the TCSEC in a very minimal fashion and the details are presented in a
much more completely in the Shon Harris, All In One book. Folk wisdom has it that this reflects the
CBK/security industry migration away from the TCSEC to the CC but the wise candidate will
develop at least some familiarity with the TCSEC. There are still questions on TCSEC showing up
randomly on the exam.
NOTE FROM CLEMENT:
As of today (April 2014) subjects such as the TCSEC are still proclaimed to be on the exam. Do
make sure that you take some time to review the TCSEC ratings.
You can download a nice one page resume of the TCSEC rating at the following link:
https://www.freepracticetests.org/documents/tcsec.pdf
Do study this one page document and get familiar with what is being introduced at each of the
TCSEC levels. Good questions might be for example:
1.At what level are labels introduced?
2.At what level is the Security Administrator role defined?
3.At what level are covert channel first introduced?
4.At what level do you use formal methods?
References:
The Official ISC2 CBK study guide, pages 329 - 330.
AIO3, pp. 302 - 306
AIOv4 Security Architecture and Design (pages 357 - 361)
AIOv5 Security Architecture and Design (pages 358 - 362)