CISSP-KR 문제 356
프로그램이 예상대로 작동하지 않습니다. 프로그램이 의도 한대로 작동하지 못하게 하는 Java의 가장 가능한 보안 기능은 무엇입니까?
Java implements the principle of least privilege through its security model, which consists of several components, such as:
The Java Virtual Machine (JVM): a software layer that executes the Java bytecode and provides an abstraction from the underlying hardware and operating system. The JVM enforces the security rules and restrictions on the Java programs, such as the memory protection, the bytecode verification, and the exception handling.
The Java Security Manager: a class that defines and controls the security policy and permissions for the Java programs. The Java Security Manager can be configured and customized by the system administrator or the user, and can grant or deny the access or actions of the Java programs, such as the file I/O, the network communication, or the system properties.
The Java Security Policy: a file that specifies the security permissions for the Java programs, based on the code source and the code signer. The Java Security Policy can be defined and modified by the system administrator or the user, and can assign different levels of permissions to different Java programs, such as the trusted or the untrusted ones.
The Java Security Sandbox: a mechanism that isolates and restricts the Java programs that are downloaded or executed from untrusted sources, such as the web or the network. The Java Security Sandbox applies the default or the minimal security permissions to the untrusted Java programs, and prevents them from accessing or modifying the local resources or data, such as the files, the databases, or the registry.
In this question, the Java program is being developed to read a file from computer A and write it to computer B, using a third computer C. This means that the Java program needs to have the permissions to perform the file I/O and the network communication operations, which are considered as sensitive or risky actions by the Java security model. However, if the Java program is running on computer C with the default or the minimal security permissions, such as in the Java Security Sandbox, then it will not be able to perform these operations, and the program will not work as expected. Therefore, the most probable security feature of Java preventing the program from operating as intended is least privilege, which limits the access or permissions of the Java program based on its source, signer, or policy.
CISSP-KR 문제 357
CISSP-KR 문제 358
Residual data in unused space can be recovered using forensic tools, and it may contain:
Fragments of deleted files (documents, images, etc.)
Metadata about deleted files
Traces of previous system activity
Since deleted data is typically not immediately erased but instead marked as available for reuse, residual data in unused space can be crucial for recovering deleted information that may still be intact.
CISSP-KR 문제 359
It increases the attack footprint, as the SDN controller becomes a single point of failure and a high-value target for attackers. If the SDN controller is compromised, the attacker can gain access to the entire network and manipulate its behavior or performance.
It exposes new attack vectors, as the SDN controller communicates with the network devices and applications via open and standardized protocols, such as OpenFlow, REST, or NETCONF.
These protocols may have vulnerabilities or weaknesses that could be exploited by attackers to launch denial-of-service, man-in-the-middle, or spoofing attacks.
It requires more trust and verification, as the SDN controller relies on the information and feedback from the network devices and applications to make decisions and enforce policies. The network devices and applications may provide inaccurate or malicious information to the SDN controller, or may not comply with the instructions or configurations from the SDN controller, leading to security breaches or inconsistencies.
CISSP-KR 문제 360
The RTO is the maximum amount of time that is allowed to restore the critical systems and resume the business operations after a disaster. The WRT is the amount of time that is needed to catch up on the backlog of work that was accumulated during the downtime. The Annual Loss Expectancy (ALE) is the expected annual loss due to a risk, calculated by multiplying the Single Loss Expectancy (SLE) and the Annualized Rate of Occurrence (ARO). The Business Impact Analysis (BIA) is a process that identifies and evaluates the critical business functions and their dependencies, and determines the impact of a disruption on them. The Recovery Point Objective (RPO) is the maximum amount of data that can be lost or corrupted without causing unacceptable consequences. The Estimated Maximum Loss (EML) is the worst-case scenario loss due to a risk, calculated by multiplying the Exposure Factor (EF) and the Asset Value (AV).
- 최근 업로드
- 151Microsoft.DP-700-KR.v2026-08-20.q47
- 338ISC.CISSP-KR.v2026-08-20.q862
- 199Microsoft.SC-100-KR.v2026-08-20.q141
- 243Microsoft.AZ-305-KR.v2026-08-20.q223
- 864IIA.IIA-CIA-Part1-KR.v2026-08-19.q374
- 1360IIA.IIA-CIA-Part3-KR.v2026-08-19.q374
- 184Microsoft.DP-700-KR.v2026-08-19.q59
- 238AMP.CRL.v2026-08-18.q46
- 895Microsoft.AZ-305-KR.v2026-08-17.q162
- 237IIA.IAA-IAP-KR.v2026-08-17.q41
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISC.CISSP-KR.v2026-08-20.q862 모의시험 시험자료를 다운 받으세요.