CISSP Practice полностью

Smart grid computing consists of interoperable standards and protocols that facilitate in providing centralized electric power generation, including distributed renewable energy resources and energy storage. Ensuring cyber security of the smart grid is essential because it improves power reliability, quality, and resilience. The goal is to build a safe and secure smart grid that is interoperable, end-to-end. Smart grid computing needs cyber security measures because it uses cyber computing.

Utility computing means allowing functional users (end-users) to access technology-based services to perform specific and simple tasks (for example, to run a storage backup program and a disk/file recovery program) without requiring much of the technical knowledge. Quantum computing deals with computers with large word sizes.

134. In a public cloud computing environment, which of the following provides client-side protection?

a. Encrypted network exchanges

b. Plug-ins and add-ins

c. Keystroke loggers

d. Virtual firewalls

134. a. Cloud clients can be browser-based or applications-based. Some organizations deploy hardened browser environments that encrypt network exchanges and protect against keystroke logging.

Plug-ins, add-ins, backdoor Trojan viruses, and keystroke loggers are examples of client-side risks or threats to be protected from. An add-in is a hardware device, such as an expansion board or chip, which can be added to a computer to expand its capabilities. An add-in can also be a supplemental program that can extend the capabilities of an application program. A plug-in is a small software program that plugs into a larger application to provide added functionality (such as graphic, video, and audio files). A keystroke logger is a program designed to record which keys are pressed on a computer keyboard and is used to obtain passwords or encryption keys and thus bypass other security measures.

135. If website owners want to protect data from unauthorized access, what should they do?

a. Create encrypted cookies

b. Create session cookies

c. Create persistent cookies

d. Create tracking cookies

135. a. A cookie is a small data file that holds information about the use of a particular website. Cookies often store data in plain text, which could allow an unauthorized party that accesses a cookie to use or alter the data stored in it. Some websites create encrypted cookies, which protect the data from unauthorized access during a user’s Web browsing session.

Session cookies are incorrect because they are temporary cookies that are valid only for a single website session. Persistent cookies are incorrect because they are stored on a computer indefinitely so that a website can identify the user during subsequent visits. These cookies can help websites serve their users more effectively. Unfortunately, persistent cookies also can be misused as spyware to track a user’s Web browsing activities for questionable reasons without the user’s knowledge or consent. Tracking cookies are incorrect because they are placed on a user’s computer to track the user’s activity on different websites, creating a detailed profile of the user’s behavior.

136. The detect-and-respond infrastructure for information assurance requires which of the following?

1. Intrusion detection

2. Cryptographic key management infrastructure

3. Monitoring software

4. Public key infrastructure

a. 1 and 2

b. 1 and 3

c. 2 and 3

d. 3 and 4

136. b. The detect-and-respond infrastructure enables rapid detection of, and reaction to, intrusions. The infrastructure required includes technical solutions such as intrusion detection, monitoring software, and skilled specialists often referred to as a computer emergency response team (CERT). The cryptographic key management infrastructure (KMI), which includes public key infrastructure (PKI), provides a common unified process for the secure creation, distribution, and management of the public key certificates and traditional symmetric keys. KMI and PKI are not directly related to detect and respond; although, they are all part of supporting infrastructure addressing information assurance.

137. Which of the following are the main approaches to mitigate risks in using active content?

1. Principles

2. Practices

3. Avoidance

4. Harm reduction

a. 1 only

b. 2 only

c. 1 and 2

d. 3 and 4