CISSP-KR 문제 101
코드의 버그를 계산하여 제 3 자의 위험을 평가하는 것은 공급망 내의 공격 표면에 대한 최선의 척도가 아닐 수 있습니다.
다음 중 공격 표면과 가장 관련이 적은 것은 무엇입니까?
다음 중 공격 표면과 가장 관련이 적은 것은 무엇입니까?
정답: C
Error messages are not part of the attack surface, which is the sum of all the points where an attacker can try to enter or extract data from a system. Error messages are the output of the system when something goes wrong, and they can reveal useful information to an attacker, such as the system version, configuration, or vulnerabilities. However, they are not directly associated with the attack surface. Input protocols, target processes, and access rights are all factors that can affect the attack surface, as they determine how the system interacts with the external environment and what resources are exposed or protected.
CISSP-KR 문제 102
자산 보안 및 적절한 보존과 관련하여, 다음 중 가장 중요하게 집중해야 할 세 가지 영역은 무엇입니까?
정답: A
Regarding asset security and appropriate retention, the initial top three areas that are important to focus on are security control baselines, access controls, employee awareness and training. Asset security and appropriate retention are the processes of identifying, classifying, protecting, and disposing of the assets of an organization, such as data, systems, devices, or facilities. Asset security and appropriate retention can help prevent or reduce the loss, theft, damage, or misuse of the assets, as well as comply with the legal and regulatory requirements. The initial top three areas that can help achieve asset security and appropriate retention are:
Security control baselines: These are the minimum set of security controls or measures that are applied to the assets based on their classification, value, and risk level. Security control baselines can help ensure the consistency, effectiveness, and efficiency of the security protection for the assets, as well as facilitate the monitoring and auditing of the security compliance. Security control baselines can include technical, administrative, or physical controls, such as encryption, authentication, policies, procedures, locks, alarms, etc Access controls: These are the mechanisms that regulate who or what can access, use, modify, or delete the assets. Access controls can help prevent or limit the unauthorized or malicious access to the assets, as well as enforce the principle of least privilege and the separation of duties. Access controls can include identification, authentication, authorization, and accountability (IAAA) processes, as well as access control models, such as discretionary, mandatory, or role- based access control Employee awareness and training: These are the activities that educate and inform the employees about the security policies, procedures, and best practices of the organization, as well as the roles and responsibilities of the employees regarding the asset security and appropriate retention. Employee awareness and training can help increase the knowledge, skills, and attitude of the employees towards security, as well as reduce the human errors, negligence, or violations that may compromise the asset security and appropriate retention. Employee awareness and training can include seminars, workshops, newsletters, posters, quizzes, etc.
Security control baselines: These are the minimum set of security controls or measures that are applied to the assets based on their classification, value, and risk level. Security control baselines can help ensure the consistency, effectiveness, and efficiency of the security protection for the assets, as well as facilitate the monitoring and auditing of the security compliance. Security control baselines can include technical, administrative, or physical controls, such as encryption, authentication, policies, procedures, locks, alarms, etc Access controls: These are the mechanisms that regulate who or what can access, use, modify, or delete the assets. Access controls can help prevent or limit the unauthorized or malicious access to the assets, as well as enforce the principle of least privilege and the separation of duties. Access controls can include identification, authentication, authorization, and accountability (IAAA) processes, as well as access control models, such as discretionary, mandatory, or role- based access control Employee awareness and training: These are the activities that educate and inform the employees about the security policies, procedures, and best practices of the organization, as well as the roles and responsibilities of the employees regarding the asset security and appropriate retention. Employee awareness and training can help increase the knowledge, skills, and attitude of the employees towards security, as well as reduce the human errors, negligence, or violations that may compromise the asset security and appropriate retention. Employee awareness and training can include seminars, workshops, newsletters, posters, quizzes, etc.
CISSP-KR 문제 103
스캔 보고서는 미션 크리티컬한 여러 프로덕션 서버에 영향을 미치는 여러 취약점을 반환했습니다. 개발 환경에서 패치를 적용하려는 시도로 인해 서버가 충돌했습니다. 최선의 조치는 무엇입니까?
정답: C
The best course of action for the situation where a scan report returned multiple vulnerabilities affecting several production servers that are mission critical, and where attempts to apply the patches in the development environment have caused the servers to crash, is to mitigate the risks with compensating controls. A vulnerability is a type of weakness or flaw in a system or a network, such as a production server, that can be exploited or leveraged by a threat or an attacker, to cause harm or damage to the system or the network, or to compromise the security, functionality, or usability of the system or the network. A vulnerability can be identified or discovered by various methods, such as a scan report, which is a document or a tool that provides the information or the data about the vulnerabilities that are found or detected on a system or a network, using various techniques, such as vulnerability scanning or penetration testing. A vulnerability can be remediated or resolved by various methods, such as a patch, which is a piece or a unit of software or code that is applied or installed on a system or a network, to fix or correct the vulnerability, and to improve the security, performance, or reliability of the system or the network. A patch can be tested or verified by various methods, such as a development environment, which is a type of setting or configuration that is used or created for developing, testing, or validating the software or code, such as a patch, before applying or installing it on a production environment, which is a type of setting or configuration that is used or created for running or operating the software or code, such as a system or a network, that is mission critical, which means that it is essential or vital for the functioning or operation of the organization or the business. A patch can also cause or introduce various problems or issues, such as a crash, which is a type of failure or malfunction that occurs on a system or a network, and that causes the system or the network to stop or terminate unexpectedly or abnormally, and to lose or corrupt the data or the information. A risk is a type of uncertainty or possibility that a threat or an attacker can exploit or leverage a vulnerability, and that can cause harm or damage to the system or the network, or to the organization or the business. A risk can be managed or handled by various methods, such as a control, which is a type of measure or action that is implemented or performed on a system or a network, to prevent or mitigate the risk, and to achieve the objectives or goals of the system or the network, or of the organization or the business. A control can be classified into various types, such as a compensating control, which is a type of control that is implemented or performed as an alternative or a substitute for the primary or the original control, such as a patch, that is not available, feasible, or effective, and that provides the equivalent or comparable level of protection or mitigation for the system or the network, or for the organization or the business. Mitigating the risks with compensating controls is the best course of action for the situation where a scan report returned multiple vulnerabilities affecting several production servers that are mission critical, and where attempts to apply the patches in the development environment have caused the servers to crash, as it can provide the benefits of both patching and testing, such as security, performance, or reliability, and as it can avoid or reduce the problems or issues, such as crash, loss, or corruption.
CISSP-KR 문제 104
디지털 서명을 구현할 때 다음 중 어떤 위협이 존재합니까?
정답: B
Substitution is a threat that occurs when an attacker replaces a valid digital signature with an invalid one, or a signature from another document. This can compromise the integrity and non- repudiation of the signed document, as the receiver cannot verify the authenticity and origin of the document. Substitution can be prevented by using secure hash algorithms and encryption to generate and protect the digital signatures.
CISSP-KR 문제 105
다음 중 조직의 전자 모니터링 정책 설계에 가장 큰 영향을 미치는 요소는 무엇입니까?
정답: A
The factor that most influences the design of the organization's electronic monitoring policies is workplace privacy laws. Workplace privacy laws are the laws that regulate the extent and manner of the employer's monitoring or surveillance of the employee's activities, communications, or behavior in the workplace, such as email, phone, internet, or video monitoring. Workplace privacy laws vary by country, state, or region, and may impose different requirements or restrictions on the employer's electronic monitoring policies, such as the purpose, scope, consent, disclosure, or protection of the monitoring data. The employer must comply with the applicable workplace privacy laws when designing and implementing the electronic monitoring policies, to avoid violating the employee's privacy rights or facing legal consequences. Level of organizational trust, results of background checks, and business ethical considerations are not the factors that most influence the design of the organization's electronic monitoring policies, as they are related to the culture, security, or values of the organization, not the legal or regulatory framework of the electronic monitoring.
- 최근 업로드
- 140Microsoft.DP-700-KR.v2026-08-20.q47
- 177ISC.CISSP-KR.v2026-08-20.q862
- 182Microsoft.SC-100-KR.v2026-08-20.q141
- 194Microsoft.AZ-305-KR.v2026-08-20.q223
- 807IIA.IIA-CIA-Part1-KR.v2026-08-19.q374
- 1297IIA.IIA-CIA-Part3-KR.v2026-08-19.q374
- 180Microsoft.DP-700-KR.v2026-08-19.q59
- 234AMP.CRL.v2026-08-18.q46
- 890Microsoft.AZ-305-KR.v2026-08-17.q162
- 233IIA.IAA-IAP-KR.v2026-08-17.q41
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISC.CISSP-KR.v2026-08-20.q862 모의시험 시험자료를 다운 받으세요.