CISSP-KR 문제 816
다음 중 SQL(구조화 쿼리 언어) 인젝션 공격을 방지하는 가장 좋은 방법은 무엇입니까?
정답: D
Structured Query Language (SQL) injection is a type of attack that exploits a vulnerability in a web application that allows an attacker to execute malicious SQL commands on a database server. SQL injection can result in data theft, data corruption, unauthorized access, or denial of service. The best way to protect against SQL injection is to use stored procedures, which are precompiled and parameterized SQL statements that are stored on the database server. Stored procedures prevent SQL injection by separating the user input from the SQL code, and by validating and sanitizing the user input before executing the SQL statement. Stored procedures also improve the performance and maintainability of the web application, as they reduce the network traffic and the code complexity. Other ways to protect against SQL injection are to enforce boundary checking, which limits the length and format of the user input, to restrict the use of SELECT command, which retrieves data from the database, and to restrict the HyperText Markup Language (HTML) source code, which displays the web page content.
CISSP-KR 문제 817
조직에서 사용자가 익명 프록시를 사용하여 승인되지 않은 웹 사이트를 방문하고 있음을 발견했습니다. 다음 중 향후 발생을 방지하는 가장 좋은 방법은 무엇입니까?
정답: D
Anonymous proxies are servers that act as intermediaries between the user and the internet, hiding the user's real IP address and allowing them to bypass network restrictions and access unauthorized websites. The best way to prevent users from visiting unauthorized websites using anonymous proxies is to block the IP address of known anonymous proxies on the firewall or router. This will prevent the user from establishing a connection with the proxy server and accessing the blocked content. Removing the anonymity from the proxy, analyzing IP traffic for proxy requests, or disabling the proxy server on the firewall are not effective ways to prevent future occurrences, as they do not address the root cause of the problem or require more resources and time to implement.
CISSP-KR 문제 818
동등성 클래스 테스트와 관련하여 다음 중 어느것이 사실입니까?
정답: C
An entire partition can be covered by considering only one representative value from that partition is a true statement regarding equivalence class testing. Equivalence class testing is a technique of software testing that divides the input domain of a function into partitions or classes that have the same expected output or behavior. By selecting only one representative value from each partition, the tester can reduce the number of test cases and still achieve high coverage and efficiency. Equivalence class testing is based on the assumption that if one value in a partition works correctly, then all other values in that partition will work correctly as well.
CISSP-KR 문제 819
다음 중 PPP (Point-to-Point Protocol)에 대한 피어 엔티티 인증 방법은 무엇입니까?
정답: A
Point-to-Point Protocol (PPP) is a network protocol that provides a simple and secure way of establishing a direct connection between two hosts over a serial link, such as a phone line or a cable. PPP supports various methods of peer entity authentication, which is the process of verifying the identity and credential of the hosts involved in the connection. One of the peer entity authentication methods supported by PPP is Challenge Handshake Authentication Protocol (CHAP). CHAP is a challenge-response authentication mechanism that uses a shared secret, such as a password, and a one-way hash function, such as MD5, to authenticate the hosts.
CHAP periodically sends a random challenge to the host, and the host responds with a hash of the challenge and the secret. The challenger then compares the hash with its own calculation and accepts or rejects the host. CHAP provides a secure and efficient way of authenticating the hosts without sending the secret over the network. Message Authentication Code (MAC), Transport Layer Security (TLS) handshake protocol, or challenge-response authentication mechanism are not peer entity authentication methods for PPP, as they are more related to data integrity, secure communication, or general authentication concepts.
CHAP periodically sends a random challenge to the host, and the host responds with a hash of the challenge and the secret. The challenger then compares the hash with its own calculation and accepts or rejects the host. CHAP provides a secure and efficient way of authenticating the hosts without sending the secret over the network. Message Authentication Code (MAC), Transport Layer Security (TLS) handshake protocol, or challenge-response authentication mechanism are not peer entity authentication methods for PPP, as they are more related to data integrity, secure communication, or general authentication concepts.
CISSP-KR 문제 820
보안 설계자는 구현을 위해 필수 액세스 제어 (MAC) 모델을 참조 할 계획입니다. 다음 중 우선 순위가 높은 특성을 나타냅니다.
정답: A
According to the CISSP Official (ISC)2 Practice Tests, the property that is prioritized by a Mandatory Access Control (MAC) model for implementation is confidentiality. Confidentiality is the property that ensures that the data or information is only accessible or disclosed to the authorized parties, and is protected from unauthorized or unintended access or disclosure. A MAC model is a type of access control model that grants or denies access to an object based on the security labels of the subject and the object, and the security policy enforced by the system. A security label is a tag or a marker that indicates the classification, sensitivity, or clearance of the subject or the object, such as top secret, secret, or confidential. A security policy is a set of rules or criteria that defines how the access decisions are made based on the security labels, such as the Bell-LaPadula model or the Biba model. A MAC model prioritizes confidentiality, as it ensures that the data or information is only accessible or disclosed to the subjects that have the appropriate security labels and clearance, and that the data or information is not leaked or compromised by the subjects that have lower security labels or clearance. Integrity is not the property that is prioritized by a MAC model for implementation, although it may be a property that is supported or enhanced by a MAC model. Integrity is the property that ensures that the data or information is accurate, complete, and consistent, and is protected from unauthorized or unintended modification or corruption. A MAC model may support or enhance integrity, as it ensures that the data or information is only modified or corrupted by the subjects that have the appropriate security labels and clearance, and that the data or information is not altered or damaged by the subjects that have lower security labels or clearance. However, a MAC model does not prioritize integrity, as it does not prevent or detect the modification or corruption of the data or information by the subjects that have the same or higher security labels or clearance, or by the external factors or events, such as errors, failures, or accidents. Availability is not the property that is prioritized by a MAC model for implementation, although it may be a property that is supported or enhanced by a MAC model. Availability is the property that ensures that the data or information is accessible and usable by the authorized parties, and is protected from unauthorized or unintended denial or disruption of access or use. A MAC model may support or enhance availability, as it ensures that the data or information is accessible and usable by the subjects that have the appropriate security labels and clearance, and that the data or information is not denied or disrupted by the subjects that have lower security labels or clearance. However, a MAC model does not prioritize availability, as it does not prevent or detect the denial or disruption of access or use of the data or information by the subjects that have the same or higher security labels or clearance, or by the external factors or events, such as attacks, failures, or disasters. Accessibility is not the property that is prioritized by a MAC model for implementation, as it is not a security property, but a usability property. Accessibility is the property that ensures that the data or information is accessible and usable by the users with different abilities, needs, or preferences, such as the users with disabilities, impairments, or limitations. Accessibility is not a security property, as it does not protect the data or information from unauthorized or unintended access, disclosure, modification, corruption, denial, or disruption. Accessibility is a usability property, as it enhances the user experience and satisfaction of the data or information.
- 최근 업로드
- 138Microsoft.DP-700-KR.v2026-08-20.q47
- 160ISC.CISSP-KR.v2026-08-20.q862
- 141Microsoft.SC-100-KR.v2026-08-20.q141
- 151Microsoft.AZ-305-KR.v2026-08-20.q223
- 795IIA.IIA-CIA-Part1-KR.v2026-08-19.q374
- 1294IIA.IIA-CIA-Part3-KR.v2026-08-19.q374
- 177Microsoft.DP-700-KR.v2026-08-19.q59
- 221AMP.CRL.v2026-08-18.q46
- 889Microsoft.AZ-305-KR.v2026-08-17.q162
- 233IIA.IAA-IAP-KR.v2026-08-17.q41
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISC.CISSP-KR.v2026-08-20.q862 모의시험 시험자료를 다운 받으세요.