한 기술자가 라디오 주변 반경에서 서비스를 제공하는 방 중앙에 WAP를 설치하려고 합니다. 다음 중 AP가 사용해야 하는 안테나 유형은 무엇입니까?
정답: A
An omni antenna is a type of antenna that radiates radio signals in all directions equally. It is also known as an omnidirectional antenna or a dipole antenna. An omni antenna is suitable for a wireless access point (WAP) that is installed in the center of a room that provides service in a radius surrounding the radio, as it can cover a large area and reach multiple devices.
CISSP-KR 문제 637
응용 프로그램 개발자가 SDN(소프트웨어 정의 네트워킹)의 노스바운드 API(응용 프로그래밍 인터페이스)에서 파생시켜야 하는 세 가지 주요 이점은 무엇입니까?
정답: D
The three key benefits that application developers should derive from the northbound application- programming interface (API) of software-defined networking (SDN) are familiar syntax, abstraction of network topology, and abstraction of network protocols. A northbound API is an API that enables the communication and interaction between the SDN controller and the applications or services that run on the network. A northbound API provides the following benefits for the application developers: Familiar syntax: A northbound API uses a common and standard programming language, such as Java, Python, or REST, that the application developers are familiar with and comfortable with. This reduces the learning curve and the complexity of developing applications for the SDN network. Abstraction of network topology: A northbound API hides the details and complexity of the underlying network infrastructure, such as devices, links, addresses, and routes, from the application developers. Instead, it provides a high-level and logical view of the network resources and capabilities, such as bandwidth, latency, and QoS, that the application developers can use and manipulate. This simplifies the application development and deployment, and enables the application developers to focus on the functionality and performance of the applications. Abstraction of network protocols: A northbound API abstracts the network protocols, such as TCP, IP, or OpenFlow, that are used to control and manage the network devices and traffic, from the application developers. Instead, it provides a uniform and consistent interface and commands that the application developers can use to request and receive network services and information. This enhances the portability and interoperability of the applications, and enables the application developers to leverage the network intelligence and optimization provided by the SDN controller.
CISSP-KR 문제 638
다중 요소 인증(MFA)은 일반적인 암호 공격 유형을 고려할 때 많은 시스템에서 필수적입니다. 다음 중 암호 공격의 올바른 목록은 무엇입니까?
정답: B
The correct list of password attacks is brute force, dictionary, phishing, and keylogger. Password attacks are the attacks that aim to guess, crack, or steal the passwords or the credentials of the users or the systems, and to gain unauthorized or malicious access to the information or the resources. Password attacks can include the following methods: - Brute force is a method that tries all possible combinations of characters or symbols until the correct password is found. - Dictionary is a method that uses a list of common or likely words or phrases as the input for guessing the password. - Phishing is a method that uses fraudulent emails or websites that impersonate legitimate entities or parties, and that trick the users into revealing their passwords or credentials. - Keylogger is a method that uses a software or a hardware device that records the keystrokes of the users, and that captures or transmits their passwords or credentials. Masquerading, salami, malware, and polymorphism are not password attacks, as they are related to the impersonation, manipulation, infection, or mutation of the data or the systems, not the guessing, cracking, or stealing of the passwords or the credentials. Zeus, netbus, rabbit, and turtle are not password attacks, as they are the names of specific types of malware, such as trojans, worms, or viruses, not the methods of attacking the passwords or the credentials. Token, biometrics, IDS, and DLP are not password attacks, as they are the types of security controls or technologies, such as authentication, identification, detection, or prevention, not the attacks on the passwords or the credentials.
CISSP-KR 문제 639
응용 프로그램 개발 중에 빠른 피드백을 위해 어떤 유형의 테스트 스위트를 실행해야 합니까?
정답: C
A smoke test suite is the type of test suite that should be run for fast feedback during application development. A smoke test suite is a subset of test cases that covers the most important and basic functionality of the application, such as loading, navigation, and input/output. A smoke test suite is designed to be executed quickly and frequently, usually before more comprehensive testing, to verify that the application is stable and ready for further testing. A smoke test suite can provide fast feedback to the developers and testers about the quality and status of the application, and help to identify and fix any major defects or errors early in the development cycle.
CISSP-KR 문제 640
다음 중 주입 및 오버플로 공격에 대한 보안 코딩 기술을 검증하는 가장 좋은 방법은 무엇입니까?
정답: B
The best method to validate secure coding techniques against injection and overflow attacks is to use automated programs to test for the latest known vulnerability patterns. Secure coding techniques are the practices and methods that aim to write software that is free from vulnerabilities or defects that could compromise the security, functionality, or performance of the software or the system. Secure coding techniques include input validation, output encoding, error handling, encryption, or logging. Injection and overflow attacks are two common types of attacks that exploit the vulnerabilities or defects in the software code, by inserting or injecting malicious or unexpected data or commands into the software, or by overflowing or exceeding the memory or buffer allocated for the software. Injection and overflow attacks can result in unauthorized access, data loss or corruption, denial of service, or remote code execution. To validate secure coding techniques against injection and overflow attacks, automated programs can be used to test for the latest known vulnerability patterns, which are the patterns or signatures that indicate the presence or occurrence of the vulnerabilities or attacks. Automated programs can provide the following advantages over other methods, such as manual review, code reuse, or code editing tools: They can increase the speed and accuracy of the testing, as the automated programs can scan and analyze the code faster and more thoroughly than human reviewers, and can detect and report the vulnerabilities or attacks more reliably and consistently than human reviewers. They can improve the coverage and completeness of the testing, as the automated programs can test the entire code or system, rather than a sample or a portion of the code or system, and can test for all the possible scenarios or inputs, rather than a limited or a predefined set of scenarios or inputs. They can enhance the currency and relevance of the testing, as the automated programs can be updated and configured to test for the latest known vulnerability patterns, rather than the outdated or obsolete vulnerability patterns, and can test for the specific or customized vulnerability patterns, rather than the generic or default vulnerability patterns.