CSSLP Practice Test

CSSLP Practice Test practice questions, page 13 of 14, with answer review and explanations.

Question 61

Which of the following statements is true about residual risks?

  1. It is the probabilistic risk after implementing all security measures.
  2. It can be considered as an indicator of threats coupled with vulnerability.
  3. It is a weakness or lack of safeguard that can be exploited by a threat.
  4. It is the probabilistic risk before implementing all security measures.

Question 62

To help review or design security controls, they can be classified by several criteria . One of these criteria is based on their nature. According to this criterion, which of the following controls consists of incident response processes, management oversight, security awareness, and training?

  1. Compliance control
  2. Physical control
  3. Procedural control
  4. Technical control

Question 63

A Web-based credit card company had collected financial and personal details of Mark before issuing him a credit card. The company has now provided Mark's financial and personal details to another company. Which of the following Internet laws has the credit card issuing company violated?

  1. Trademark law
  2. Security law
  3. Privacy law
  4. Copyright law

Question 64

There are seven risks responses that a project manager can choose from. Which risk response is appropriate for both positive and negative risk events?

  1. Acceptance
  2. Transference
  3. Sharing
  4. Mitigation

Question 65

You work as a Security Manager for Tech Perfect Inc. In the organization, Syslog is used for computer system management and security auditing, as well as for generalized informational, analysis, and debugging messages. You want to prevent a denial of service (DoS) for the Syslog server and the loss of Syslog messages from other sources. What will you do to accomplish the task?

  1. Use a different message format other than Syslog in order to accept data.
  2. Enable the storage of log entries in both traditional Syslog files and a database.
  3. Limit the number of Syslog messages or TCP connections from a specific source for a certain time period.
  4. Encrypt rotated log files automatically using third-party or OS mechanisms.