CISSP Sample Test 错题集2

Use the following scenario to answer Questions 1–3. Josh has discovered that an organized
hacking ring in China has been targeting his company’s research and development department. If
these hackers have been able to uncover his company’s research finding, this means they
probably have access to his company’s intellectual property. Josh thinks that an e-mail server in
his company’s DMZ may have been successfully compromised and a rootkit loaded.

1. Based upon this scenario, what is most likely the biggest risk Josh’s company needs to be
concerned with?
A. Market share drop if the attackers are able to bring the specific product to market more
quickly than Josh’s company.
B. Confidentiality of e-mail messages. Attackers may post all captured e-mail messages to
the Internet.
C. Impact on reputation if the customer base finds out about the attack.
D. Depth of infiltration of attackers. If attackers have compromised other systems, more
confidential data could be at risk.

A. While they are all issues to be concerned with, risk is a combination of probability and
business impact. The largest business impact out of this list and in this situation is the fact
that intellectual property for product development has been lost. If a competitor can
produce the product and bring it to market quickly, this can have a long-lasting financial
impact on the company.

7. Jane is suspicious that an employee is sending sensitive data to one of the company’s
competitors. The employee has to use this data for daily activities, thus it is difficult to
properly restrict the employee’s access rights. In this scenario, which best describes the
company’s vulnerability, threat, risk, and necessary control?
A. Vulnerability is employee access rights, threat is internal entities misusing privileged
access, risk is the business impact of data loss, and the necessary control is detailed
network traffic monitoring.
B. Vulnerability is lenient access rights, threat is internal entities misusing privileged
access, risk is the business impact of data loss, and the necessary control is detailed user
monitoring.
C. Vulnerability is employee access rights, threat is internal employees misusing
privileged access, risk is the business impact of confidentiality, and the necessary
control is multifactor authentication.
D. Vulnerability is employee access rights, threat is internal users misusing privileged
access, risk is the business impact of confidentiality, and the necessary control is
CCTV.

B. A vulnerability is a lack or weakness of a control. In this situation the access control
may be weak in nature, thus exploitable. The vulnerability is that the user, who must be
given access to the sensitive data, is not properly monitored to deter and detect a willful
breach of security. The threat is that any internal entity might misuse given access. The risk
is the business impact of losing sensitive data. One control that could be put into place is
monitoring so that access activities can be closely watched.

9. Mark works for a large corporation operating in multiple countries worldwide. He is
reviewing his company’s policies and procedures dealing with data breaches. Which of the following is an issue that he must take into consideration?
A. Each country may or may not have unique notification requirements.
B. All breaches must be announced to affected parties within 24 hours.
C. Breach notification is a “best effort” process and not a guaranteed process.
D. Breach notifications are avoidable if all PII is removed from data stores.

11. All of the following should be considered as part of the supply chain risk management
process for a smartphone manufacturer except
A. Hardware Trojans inserted by downstream partners
B. ISO/IEC 27001
C. Hardware Trojans inserted by upstream partners
D. NIST Special Publication 800-161

B. ISO/IEC 27001 is a standard covering information security management systems, which
is a much broader topic than supply chain risk management. The other three options are
better answers because they are directly tied to this process: NIST’s Special Publication
800-161 directly addresses supply chain risk, and the insertion of hardware Trojans could
happen at any point in the chain.

Use the following scenario to answer Questions 13–15. Jack has just been hired as the security
officer for a large hospital. The organization develops some of its own proprietary applications.
The organization does not have as many layers of controls when it comes to the data processed
by these applications, since it is assumed that external entities will not understand the internal
logic of the applications. One of the first things that Jack wants to carry out is a risk assessment
to determine the organization’s current risk profile. He also tells his boss that the hospital should
become ISO certified to bolster its customers’ and partners’ confidence.

13. Which of the following approaches has been implemented in this scenario?
A. Defense-in-depth
B. Security through obscurity
C. Information security management system
D. BS 17799

B. Security through obscurity is depending upon complexity or secrecy as a protection
method. Some organizations feel that since their proprietary code is not standards based,
outsiders will not know how to compromise its components. This is an insecure approach.
Defense-in-depth is a better approach with the assumption that anyone can figure out how
something works.

17.The confidentiality of sensitive data is protected in different ways depending on the state of
the data. Which of the following is the best approach to protecting data in transit?
A. SSL
B. VPN
C. IEEE 802.1x
D. Whole-disk encryption

B. A virtual private network (VPN) provides confidentiality for data being exchanged
between two endpoints. While the use of VPNs may not be sufficient in every case, it is the
only answer among those provided that addresses the question. The use of Secure Sockets
Layer (SSL) is not considered secure. IEEE 802.1x is an authentication protocol that does
not protect data in transit. Finally, whole-disk encryption may be a good approach to
protecting sensitive data, but only while it is at rest.

24. George is the security manager of a large bank, which provides online banking and other
online services to its customers. George has recently found out that some of the bank’s
customers have complained about changes to their bank accounts that they did not make.
George worked with the security team and found out that all changes took place after
proper authentication steps were completed. Which of the following describes what most
likely took place in this situation?
A. Web servers were compromised through cross-scripting attacks.
B. TLS connections were decrypted through a man-in-the-middle attack.
C. Personal computers were compromised with Trojan horses that installed keyloggers.
D. Web servers were compromised and masquerading attacks were carried out.

C. While all of these situations could have taken place, the most likely attack type in this
scenario is the use of a keylogger. Attackers commonly compromise personal computers by
tricking the users into installing Trojan horses that have the capability to install keystroke
loggers. The keystroke logger can capture authentication data that the attacker can use to
authenticate as a legitimate user and carry out malicious activities.

25. Internet Protocol Security (IPSec) is actually a suite of protocols. Each protocol within the
suite provides different functionality. Which of the following is not a function or
characteristic of IPSec?
A. Encryption
B. Link layer protection
C. Authentication
D. Protection of packet payloads and the headers

B. IPSec is a protocol used to provide VPNs that use strong encryption and authentication
functionality. It can work in two different modes: tunnel mode (payload and headers are
protected) or transport mode (payload protection only). IPSec works at the network layer,
not the data link layer.

33. Next-generation firewalls combine the best attributes of other types of firewalls. Which of
the following is not a common characteristic of these firewall types?
A. Integrated intrusion prevention system
B. Sharing signatures with cloud-based aggregators
C. Automated incident response
D. High cost

C. Incident response typically requires humans in the loop. Next-generation firewalls
(NGFWs) do not completely automate the process of responding to security incidents.
NGFWs typically involve integrated IPS and signature sharing capabilities with cloudbased
aggregators, but are also significantly more expensive than other firewall types.

38. A ____________ is the amount of time it should take to recover from a disaster, and a
____________ is the amount of data, measured in time, that can be lost and be tolerable
from that same event.
A. recovery time objective, recovery point objective
B. recovery point objective, recovery time objective
C. maximum tolerable downtime, work recovery time
D. work recovery time, maximum tolerable downtime

A. A recovery time objective (RTO) is the amount of time it takes to recover from a
disaster, and a recovery point objective (RPO) is the amount of data, measured in time, that
can be lost and be tolerable from that same event. The RPO is the acceptable amount of
data loss measured in time. This value represents the earliest point in time by which data
must be recovered. The higher the value of data, the more funds or other resources that can
be put into place to ensure a smaller amount of data is lost in the event of a disaster. RTO is
the maximum time period within which a business process must be restored to a designated
service level after a disaster

41. The Mobile IP protocol allows location-independent routing of IP datagrams on the
Internet. Each mobile node is identified by its ___________, disregarding its current
location in the Internet. While away from its home network, a mobile node is associated
with a ____________.
A. prime address, care-of address
B. home address, care-of address
C. home address, secondary address
D. prime address, secondary address

B. The Mobile IP protocol allows location-independent routing of IP packets on web-based
environments. Each mobile device is identified by its home address. While away from its
home network, a mobile node is associated with a care-of address, which identifies its
current location, and its home address is associated with the local endpoint of a tunnel to its
home agent. Mobile IP specifies how a mobile device registers with its home agent and
how the home agent routes packets to the mobile device.

45. System ports allow different computers to communicate with each other’s services and
protocols. The Internet Corporation for Assigned Names and Numbers has assigned
registered ports to be ______________ and dynamic ports to be _____________.
A. 0–1024, 49152–65535
B. 1024–49151, 49152–65535
C. 1024–49152, 49153–65535
D. 0–1024, 1025–49151

B. Registered ports are 1024–49151, which can be registered with the Internet Corporation
for Assigned Names and Numbers (ICANN) for a particular use. Vendors register specific
ports to map to their proprietary software. Dynamic ports are 49152–65535 and are
available to be used by any application on an “as needed” basis.

Use the following scenario to answer Questions 48–49. Frank is the new manager of the in-house software designers and programmers. He has been telling his team that before design and
programming on a new product begins, a formal architecture needs to be developed. He also
needs this team to understand security issues as they pertain to software design. Frank has shown the team how to follow a systematic approach that allows them to understand how different compromises could take place with the software products they develop.

48. Which of the following best describes what an architecture is in the context of this
scenario?
A. Tool used to conceptually understand the structure and behavior of a complex entity
through different views
B. Formal description and representation of a system and the components that make it up
C. Framework used to create individual architectures with specific views
D. Framework that is necessary to identify needs and meet all of the stakeholder
requirements

A. An architecture is a tool used to conceptually understand the structure and behavior of a
complex entity through different views. An architecture provides different views of the
system, based upon the needs of the stakeholders of that system.

在这个场景中，正确的答案是 A："Tool used to conceptually understand the structure and behavior of a complex entity through different views"（用于通过不同视图概念性地理解复杂实体的结构和行为的工具）。

让我们详细分析这个答案以及为什么其他选项不合适：

A. 为什么是正确答案？

1. 概念性理解：架构首先是一个工具，用于帮助团队理解系统的整体结构。
2. 多视图特性：强调通过"different views"（不同视图）来理解系统，这是软件架构的关键特征。
3. 结构和行为：涵盖了系统的静态（结构）和动态（行为）方面。
4. 复杂性管理：强调了架构在处理复杂系统时的作用。

B. 为什么不正确？

• "Formal description and representation of a system"（系统的正式描述和表示）
• 这个定义过于局限于文档层面，没有体现架构作为工具的实用性。
• 缺少了多视图的概念。

C. 为什么不正确？

• "Framework used to create individual architectures"（用于创建单个架构的框架）
• 混淆了架构框架和架构本身的概念。
• 过于强调创建过程而不是理解系统。

D. 为什么不正确？

• "Framework that is necessary to identify needs"（用于识别需求的框架）
• 过于强调需求分析的角色。
• 没有突出架构在系统理解和设计中的核心作用。

为什么这个答案最符合场景？

1. 场景背景：

   • Frank是新经理，需要向团队介绍架构的概念。
   • 团队需要在开始设计和编程之前开发正式架构。

2. 业务需求：

   • 需要理解复杂的软件产品。
   • 需要考虑安全问题。
   • 需要系统性地理解潜在的安全漏洞。

3. 架构的作用：

   • 作为理解工具，帮助团队把握整体。
   • 通过不同视角审视系统。
   • 帮助识别潜在的安全问题。

4. 实际应用：

   • 帮助团队在开发前理解系统结构。
   • 提供多个视角来评估安全风险。
   • 支持系统性地分析潜在问题。

总结

答案A最准确地描述了软件架构在该场景中的角色：它是一个工具，通过提供多个视角来帮助团队理解复杂系统的结构和行为。这与Frank想要在开发前建立正式架构的目标，以及需要团队理解安全问题的要求完全吻合。这个定义强调了架构作为理解和沟通工具的重要性，而不是仅仅将其视为文档或框架。

49. Which of the following best describes the approach Frank has shown his team as outlined
in the scenario?
A. Attack surface analysis
B. Threat modeling
C. Penetration testing
D. Double-blind penetration testing

在这个场景中，最合适的答案是 B. Threat modeling（威胁建模）。

理由：

1. 基础定义：

   • 威胁建模 是一种系统性的方法，用于识别和分析系统中的潜在威胁。它帮助团队理解他们的软件设计中的安全风险。
   • 该方法关注潜在攻击者如何利用软件中的缺陷，以及如何对系统进行攻击。

2. Frank的目标：

   • Frank希望他的团队在设计和编程新的产品之前进行正式的架构开发，并理解安全问题。
   • 这与威胁建模的目标高度一致，威胁建模提供了一个框架来识别和评估设计中的安全风险。

其他选项分析：

• A. Attack surface analysis（攻击面分析）：

  • 这主要是识别可被攻击者利用的系统功能或接口。虽然它与安全相关，但不如威胁建模全面，不能仅单独描述Frank的方法。

• C. Penetration testing（渗透测试）：

  • 这是一种模拟攻击的过程，用于测试系统的安全性。它通常是在开发后期进行，以验证系统的安全措施，而不是在设计阶段进行。

• D. Double-blind penetration testing（双盲渗透测试）：

  • 这是渗透测试的一种形式，其中测试团队和目标组织都不知情。这与Frank的团队在开发阶段进行的架构设计和安全检查没有直接关系。

总结：

Frank所展示的系统方法和目标与威胁建模的理念相符。他通过帮助团队理解潜在的安全问题并采取系统的方法来识别攻击者可能的行为，从而确保软件设计的安全性。因此，最佳答案是 B. Threat modeling。

B. Threat modeling is a systematic approach used to understand how different threats could
be realized and how a successful compromise could take place. A threat model is a
description of a set of security aspects that can help define a threat and a set of possible
attacks to consider. It may be useful to define different threat models for one software
product. Each model defines a narrow set of possible attacks to focus on. A threat model
can help to assess the probability, the potential harm, and the priority of attacks, and thus
help to minimize or eradicate the threats.

50. Barry was told that the IDS product that is being used on the network has heuristic
capabilities. Which of the following best describes this functionality?
A. Gathers packets and reassembles the fragments before assigning anomaly values
B. Gathers data to calculate the probability of an attack taking place
C. Gathers packets and compares their payload values to a signature engine
D. Gathers packet headers to determine if something suspicious is taking place within the
network traffic

B. IDS and some antimalware products are said to have “heuristic” capabilities. The term
heuristic means to create new information from different data sources. The IDS gathers
different “clues” from the network or system and calculates the probability an attack is
taking place. If the probability hits a set threshold, then the alarm sounds.

在这个场景中，提到网络上的入侵检测系统（IDS）具备**启发式（heuristic）**能力。正确的答案是 B. Gathers data to calculate the probability of an attack taking place（收集数据以计算攻击发生的概率）。

理由：

1. 启发式检测的定义：

   • 启发式检测是一种使用算法和分析方法来识别潜在的攻击或异常行为，而不是基于已知的签名。它可以通过学习和识别可疑模式来计算某种攻击发生的可能性。
   • 这种方法通常包括对流量特征、行为模式和其他数据的分析，以评估其是否符合攻击模式或异常活动。

2. 其他选项分析：

   • A. Gathers packets and reassembles the fragments before assigning anomaly values：
     • 这描述的是对数据包的重组和异常值的指派，但并不能体现启发式分析的核心。
   • C. Gathers packets and compares their payload values to a signature engine：
     • 这更符合特征匹配（signature-based）检测，而不是启发式检测。启发式系统关注的是模式和行为，而不是直接比较签名。
   • D. Gathers packet headers to determine if something suspicious is taking place within the network traffic：
     • 虽然检查包头可以用于检测可疑活动，但这通常与简单的分析方法相关，而启发式检查更侧重于基于统计分析和概率来判断是否有攻击。

总结：

启发式检测的核心在于通过对数据的分析来推断攻击的可能性。它并不依赖于已知的特征或签名，而是依据行为模式和数据特征。基于这个理解，最佳答案是 B. Gathers data to calculate the probability of an attack taking place。

56. In a VoIP environment, the Real-time Transport Protocol (RTP) and RTP Control Protocol
(RTCP) are commonly used. Which of the following best describes the difference between
these two protocols?
A. RTCP provides a standardized packet format for delivering audio and video over IP
networks. RTP provides out-of-band statistics and control information to provide
feedback on QoS levels.
B. RTP provides a standardized packet format for delivering data over IP networks. RTCP
provides control information to provide feedback on QoS levels.
C. RTP provides a standardized packet format for delivering audio and video over MPLS
networks. RTCP provides control information to provide feedback on QoS levels.
D. RTP provides a standardized packet format for delivering audio and video over IP
networks. RTCP provides out-of-band statistics and control information to provide
feedback on QoS levels.

D. The actual voice stream is carried on media protocols such as the Real-time Transport
Protocol (RTP). RTP provides a standardized packet format for delivering audio and video
over IP networks. RTP is a session layer protocol that carries data in media stream format,
as in audio and video, and is used extensively in VoIP, telephony, video conferencing, and
other multimedia streaming technologies. It provides end-to-end delivery services and is
commonly run over the transport layer protocol UDP. RTP Control Protocol (RTCP) is
used in conjunction with RTP and is also considered a session layer protocol. It provides
out-of-band statistics and control information to provide feedback on QoS levels of
individual streaming multimedia sessions.

在VoIP环境中，实时传输协议（RTP）和实时传输控制协议（RTCP）是常用的协议。要理解这两个协议之间的区别，可以从它们的主要功能进行分析：

1. RTP（实时传输协议）：RTP旨在通过IP网络传输音频和视频。它提供了实时数据传输的机制，包括时间戳功能，帮助同步音频和视频流，并处理不同的编解码器。

2. RTCP（实时传输控制协议）：RTCP与RTP一起工作，用于监控数据传输的服务质量（QoS）。它提供了传输的统计信息，促进关于媒体流状态的反馈。RTCP允许会话中的参与者通过发送控制数据包来保持彼此的认知，这些数据包包含发送者和传递的RTP数据包的质量信息。

根据以上理解，让我们评估给出的选项：

• 选项A: RTCP提供标准化的数据包格式，用于通过IP网络传递音频和视频。RTP提供带外统计数据和控制信息，以反馈QoS水平。 （错误 - 这反转了RTP和RTCP的角色。）

• 选项B: RTP提供标准化的数据包格式，用于通过IP网络传递数据。RTCP提供控制信息以反馈QoS水平。 （部分正确，但缺乏关于音频和视频的具体性。）

• 选项C: RTP提供标准化的数据包格式，用于通过MPLS网络传输音频和视频。RTCP提供控制信息以反馈QoS水平。 （错误 - RTP专门用于IP网络，而非MPLS网络。）

• 选项D: RTP提供标准化的数据包格式，用于通过IP网络传输音频和视频。RTCP提供带外统计数据和控制信息，以反馈QoS水平。 （正确 - 准确描述了每个协议的功能。）

因此，最佳选项是 D：RTP提供标准化的数据包格式，用于通过IP网络传输音频和视频。RTCP提供带外统计数据和控制信息，以反馈QoS水平。

Use the following scenario to answer Questions 61–62. Jim works for a large energy company.
His senior management just conducted a meeting with Jim’s team with the purpose of reducing
IT costs without degrading their security posture. The senior management decided to move all
administrative systems to a cloud provider. These systems are proprietary applications currently
running on Linux servers.

61. Which of the following services would allow Jim to transition all administrative custom
applications to the cloud while leveraging the service provider for security and patching of
the cloud platforms?
A. IaaS
B. PaaS
C. SaaS
D. IDaaS

B. In a Platform as a Service (PaaS) contract, the service provider normally takes care of all
configuration, patches, and updates for the virtual platform. Jim would only have to worry
about porting the applications and running them.

在这个场景中，为了使Jim能够将所有管理自定义应用程序迁移到云中，同时利用服务提供商进行云平台的安全性和补丁管理，最佳选择是：

B. PaaS（平台即服务）

理由：

1. IaaS（基础设施即服务）：提供基础的基础设施资源（如服务器和存储），但用户仍然需要管理操作系统和应用程序，因此需要自行处理安全性和补丁，而这不是Jim团队的目标。

2. PaaS（平台即服务）：该服务为客户提供开发、运行和管理应用程序的平台，无需构建和维护与开发和启动应用程序相关的基础设施。PaaS提供商会处理底层基础设施，包括安全性和补丁管理，这满足了将管理系统安全性和维护责任转交给云服务提供商的需求。

3. SaaS（软件即服务）：通常指的是使用由云提供商托管的软件，如果JIm的团队需要迁移的是专有的自定义应用程序，这不太适用。

4. IDaaS（身份即服务）：专注于身份管理和访问控制与应用程序迁移无直接关系。

综上所述，PaaS是最合适的选择，因为它能够提供必要的环境以部署自定义应用程序，同时减轻了对底层平台安全性和补丁管理的担忧。

62. Which of the following would not be an issue that Jim would have to consider in
transitioning administrative services to the cloud?
A. Privacy and data breach laws in the country where the cloud servers are located
B. Loss of efficiencies, performance, reliability, scalability, and security
C. Security provisions in the terms of service
D. Total cost of ownership compared to the current systems

B. The biggest advantages of cloud computing are enhanced efficiency, performance,
reliability, scalability, and security. Still, cloud computing is not a panacea. We must still
carefully consider legal, contractual, and cost issues since they could potentially place an
organization in a difficult position.

在将行政服务迁移到云时，Jim需要考虑的各种因素中，以下选项是不会成为问题的：

B. Loss of efficiencies, performance, reliability, scalability, and security

理由：

1. A. Privacy and data breach laws in the country where the cloud servers are located：在云迁移过程中，数据隐私和数据泄露法律是非常重要的考虑因素，因为这些法律会影响公司的合规性和数据处理方式，因此这是一个需要考虑的问题。

2. B. Loss of efficiencies, performance, reliability, scalability, and security：这个选项指出了可能的劣势，实际上，Jim在迁移时的目标是通过云计算提升效率、性能和可扩展性，而不是失去这些优势。因此，这并不是他需要考虑的一个问题，反而是他希望通过迁移达到的结果。

3. C. Security provisions in the terms of service：云服务的安全条款是必需考虑的，因为它直接影响到如何保护数据和技术资源。

4. D. Total cost of ownership compared to the current systems：这也是重要的考量，因为Jim需要评估云服务的总拥有成本，以确保迁移带来的经济效益。

因此，选择 B 是正确答案，因为它“不属于”Jim需要考虑的实际问题。

63. Henry is the team leader of a group of software designers. They are at a stage in their
software development project where they need to reduce the amount of code running,
reduce entry points available to untrusted users, reduce privilege levels as much as
possible, and eliminate unnecessary services. Which of the following best describes the
first step the team needs to carry out to accomplish these tasks?
A. Attack surface analysis
B. Software development life cycle
C. Risk assessment
D. Unit testing

A. The aim of an attack surface analysis is to identify and reduce the amount of code
accessible to untrusted users. The basic strategies of attack surface reduction are to reduce
the amount of code running, reduce entry points available to untrusted users, reduce
privilege levels as much as possible, and eliminate unnecessary services. Attack surface
analysis is generally carried out through specialized tools to enumerate different parts of a
product and aggregate their findings into a numerical value. Attack surface analyzers
scrutinize files, registry keys, memory data, session information, processes, and services
details.

69. When a CPU is passed an instruction set and data to be processed and the program status
word (PSW) register contains a value indicating that execution should take place in
privileged mode, which of the following would be considered true?
A. Operating system is executing in supervisory mode.
B. Request came from a trusted process.
C. Functionality that is available in user mode is not available.
D. An untrusted process submitted the execution request.

B. If the PSW has a bit value that indicates the instructions to be executed should be carried
out in privileged mode, this means a trusted process (e.g., an operating system process)
made the request and can have access to the functionality that is not available in user mode.

在这个情境中，当CPU收到一个指令集和要处理的数据，并且程序状态字（PSW）寄存器中包含一个值，表示应该以特权模式执行时，可以认为：

A. Operating system is executing in supervisory mode.

理由：

1. A. Operating system is executing in supervisory mode：特权模式（或内核模式）通常是指操作系统或核心功能的执行模式。在这一模式下，操作系统可以执行所有指令，并直接访问硬件，而不受用户模式的限制。因此，此选项是正确的。

2. B. Request came from a trusted process：虽然特权模式通常与可信进程关联，但这并不是必然的，因为任何经过验证的操作都可以触发特权模式的执行。

3. C. Functionality that is available in user mode is not available：这种说法不太准确。在特权模式中，操作系统可以访问用户模式以及系统提供的其他功能，反而是用户模式不允许访问特权功能。

4. D. An untrusted process submitted the execution request：特权模式的执行并不一定意味着请求来自不可信的进程。实际上，特权模式通常是操作系统处理系统调用和其他重要任务的地方。

因此，最合适的答案是 A，因为这表明操作系统正在以特权模式执行，这是与PSW寄存器中的值相符的情况。

Supervisory mode跟Privilleged mode是一样的模式么？监控态不应该是当进程需要进行系统调用或者内核交互的时候进入的状态么？如果这样理解是否上述题目B是最佳答案呢

你提到的问题非常重要。确实，supervisory mode（监控模式）和 privileged mode（特权模式）通常被视为同一种模式，它们都允许系统访问硬件和执行特权操作。这种模式通常用于操作系统的内核，允许访问所有指令和资源。以下是对你提出问题的澄清：

1. Privileged Mode和Supervisory Mode：这两者通常用于描述计算机体系结构中的相同模式。它们允许程序执行更高权限的操作，例如直接与硬件交互、管理内存和执行系统调用。两者可以互换使用。

2. 用户模式与特权模式：用户模式通常用于用户应用程序，限制对硬件和操作系统资源的访问，而特权模式允许直接和全面的访问。

3. 关于B选项的理解：

   • 选项 B. Request came from a trusted process 的确可以被视为在特权模式下执行请求的一个合理推测，因为通常情况下只有经过验证的、可信的进程（如操作系统本身或具有适当权限的进程）能够发出这样的请求。
   • 系统调用System API Calls（例如对文件系统或网络的访问）确实是常见的特权模式活动，用户进程通过系统调用接口请求操作系统执行任务并可能进入特权模式。

因此，基于你对问题的理解，实际上，可以认为 B 也是一个合理的答案。如果上下文暗示了请求来自可信进程，或者特权模式的执行是为了响应某些经过认证的请求，那么 B 是更符合这一情境的答案。

然而，如果我们仅从特权模式的定义出发， A 依然是正确的，因为特权模式的存在本身意味着操作系统在执行。因此，A和B选项在一些上下文下可能都成立，但如果我们想强调特权模式的合理性和请求来源，B 作为最佳答案也是有依据的。

73. In order to be admissible in court, evidence should normally be which of the following?
A. Subpoenaed
B. Relevant
C. Motioned
D. Adjudicated

B. It is important that evidence be relevant, complete, sufficient, and reliable to the case at
hand. These four characteristics of evidence provide a foundation for a case and help
ensure that the evidence is legally permissible.

在法庭上，证据通常需要具有的条件是：

B. Relevant

理由：

1. A. Subpoenaed：虽然某些证据可能需要传唤（subpoena）来获得，但传唤本身并不是证据被接受的法庭标准。

2. B. Relevant：证据必须与案件的事实相关，能够帮助支持或反驳案件中的主张。这是证据在法庭上被接受的一个基本要求。

3. C. Motioned：动议（motion）通常是法庭程序的一部分，用于请求法官对某事做出裁决，但这不是证据被接受的条件。

4. D. Adjudicated：裁决（adjudicated）表示由法庭或法官对案件的最终裁决，而不是证据本身的接受条件。

因此，B. Relevant 是最符合证据在法院上 admissible（可采纳）条件的答案。

74. A fraud analyst with a national insurance company uses database tools every day to help
identify violations and identify relationships between the captured data through the uses of
rule discovery. These tools help identify relationships among a wide variety of information
types. What kind of knowledge discovery in database (KDD) is this considered?
A. Probability
B. Statistical
C. Classification
D. Behavioral

B. Data mining is also known as knowledge discovery in database (KDD), which is a
combination of techniques used to identify valid and useful patterns. Different types of data
can have various interrelationships, and the method used depends on the type of data and
patterns that are sought. The following are three approaches used in KDD systems to
uncover these patterns:
• Classification Groups together data according to shared similarities
• Probabilistic Identifies data interdependencies and applies probabilities to their
relationships
• Statistical Identifies relationships between data elements and uses rule discovery

此题关键词是：

1. "identify relationships between captured data"（识别捕获数据之间的关系）
2. "through the uses of rule discovery"（通过规则发现）
3. "identify relationships among a wide variety of information types"（识别各种信息类型之间的关系）

最合适的答案应该是：

B. Statistical（统计分析）

理由：

1. 这个场景描述的是在大量数据中寻找关系和模式，这是统计分析的核心功能：

   • 统计分析能够处理大量数据
   • 能够发现数据之间的相关性和关系
   • 适合处理各种不同类型的信息
   • 通过统计方法发现规则和模式

2. 其他选项不够准确：

   • A. Probability：概率是统计分析的一部分，范围过于狭窄
   • C. Classification：分类是将数据分到预定义的类别中，而题目强调的是发现关系
   • D. Behavioral：行为分析更关注具体的行为模式，而不是普遍的数据关系

3. 在欺诈检测中，统计分析通常用于：

   • 发现异常模式
   • 建立数据之间的相关性
   • 识别潜在的欺诈指标
   • 分析各种类型数据之间的关系

所以，考虑到题目强调的是发现数据关系和规则，Statistical（统计分析）是最准确的答案。

80. Which of the following best describes the difference between the role of the ISO/IEC
27000 series and COBIT?
A. COBIT provides a high-level overview of security program requirements, while the
ISO/IEC 27000 series provides the objectives of the individual security controls.
B. The ISO/IEC 27000 series provides a high-level overview of security program
requirements, while COBIT provides the objectives of the individual security controls.
C. COBIT is process oriented, and the ISO/IEC 27000 series is solution oriented.
D. The ISO/IEC 27000 series is process oriented, and COBIT is solution oriented.

B. The ISO/IEC 27000 series provides a high-level overview of security program
requirements, while COBIT provides the objectives of the individual security controls.
COBIT provides the objectives that the real-world implementations (controls) you chose to
put into place need to meet.

83. Information security is a field that is maturing and becoming more organized and
standardized. Organizational security models should be based upon a formal architecture
framework. Which of the following best describes what a formal architecture framework is
and why it would be used?
A. Mathematical model that defines the secure states that various software components can
enter and still provide the necessary protection
B. Conceptual model that is organized into multiple views addressing each of the
stakeholder’s concerns
C. Business enterprise framework that is broken down into six conceptual levels to ensure
security is deployed and managed in a controllable manner

B. A formal architecture framework is a conceptual model in which an architecture
description is organized into multiple architecture views, where each view addresses
specific concerns originating with the specific stakeholders. Individual stakeholders have a
variety of system concerns, which the architecture must address. To express these
concerns, each view applies the conventions of its architecture viewpoint.

在信息安全领域，一个正式的架构框架是指一个结构化的方法，用于提升和标准化组织的安全性。根据这个描述，最符合定义的选项是：

B. Conceptual model that is organized into multiple views addressing each of the stakeholder’s concerns

理由：

1. A. Mathematical model that defines the secure states：虽然数学模型可以用作某些安全系统的分析工具，但它不概括整个架构框架的多个视角或利益相关者的考虑。

2. B. Conceptual model that is organized into multiple views addressing each of the stakeholder’s concerns：此选项准确描述了一个正式架构框架，因为它通常会考虑多种利益相关者的不同需求与关注点，并通过多个视图进行组织，以确保满足所有相关的安全考虑。

3. C. Business enterprise framework that is broken down into six conceptual levels：虽然商业框架可能涉及安全的各个层面，但这个描述过于具体，且并不普遍适用于所有的正式架构框架。

4. D. Enterprise framework that allows for proper security governance：尽管安全治理是架构框架的重要组成部分，但此选项没有完全捕捉正式架构框架的多视角特性。

综上所述，B 是最合适的答案，因为它准确描述了一个正式架构框架的多视图结构和利益相关者的考虑。

92. Which of the following is not an advantage of using content distribution networks?
A. Improved responsiveness to regional users
B. Resistance to ARP spoofing attacks
C. Customization of content for regional users
D. Resistance to DDoS attacks

B. Content distribution networks (CDNs) work by replicating content across
geographically dispersed nodes. This means that regional users (those closest to a given
node) will see improved responsiveness and could have tailored content delivered to them.
It also means that it is much more difficult to mount a successful DDoS attack. An ARP
spoofing attack, however, takes place on the local area network and is therefore unrelated
to the advantages of CDNs.

99. Jay is the security administrator at a credit card processing company. The company has
many identity stores, which are not properly synchronized. Jay is going to oversee the
process of centralizing and synchronizing the identity data within the company. He has
determined that the data in the HR database will be considered the most up-to-date data,
which cannot be overwritten by the software in other identity stores during their
synchronization processes. Which of the following best describes the role of this database
in the identity management structure of the company?
A. Authoritative system of record
B. Infrastructure source server
C. Primary identity store
D. Hierarchical database primary

A. An authoritative system of record (ASOR) is a hierarchical tree-like structure system
that tracks subjects and their authorization chains. The authoritative source is the “system
of record,” or the location where identity information originates and is maintained. It
should have the most up-to-date and reliable identity information.

在这种情况下，Jay 确定 HR 数据库中的数据将被视为最新数据，且在同步过程中不会被其他身份存储中的软件覆盖。这种情况下，HR 数据库的角色可以被描述为：

A. Authoritative system of record

理由：

1. A. Authoritative system of record：这个选项最准确。一个“权威记录系统”是指在多个来源的数据中被认为是最可靠和最新的数据源。在这种情况下，HR 数据库被视为身份管理结构中的权威来源。

2. B. Infrastructure source server：虽然基础设施源服务器可能参与提供某种数据，但它不是描述数据的权威性或最新性的合适术语。

3. C. Primary identity store：虽然 HR 数据库可以被视为主要身份存储，但由于它特别被描述为不能被覆盖，因此“权威记录系统”更准确地反映了它在身份管理中的角色。

4. D. Hierarchical database primary：这个选项与具体的数据库设计有关，而不是反映其在身份管理结构中的角色。

综上所述，A. Authoritative system of record 是最适合的答案，因为HR数据库作为最新数据源的地位使其成为公司的权威记录系统。

100. Proper access control requires a structured user provisioning process. Which of the
following best describes user provisioning?
A. The creation, maintenance, and deactivation of user objects and attributes as they exist
in one or more systems, directories, or applications, in response to business processes
B. The creation, maintenance, activation, and delegation of user objects and attributes as
they exist in one or more systems, directories, or applications, in response to
compliance processes
C. The maintenance of user objects and attributes as they exist in one or more systems,
directories, or applications, in response to business processes
D. The creation and deactivation of user objects and attributes as they exist in one or more
systems, directories, or applications, in response to business processes

理由：

1. A. The creation, maintenance, and deactivation...：这个选项涵盖了用户生命周期管理的所有关键环节，包括用户对象和属性的创建、维护和停用。这个过程是根据业务流程进行的，这反映了用户供应的全面概念。

2. B. The creation, maintenance, activation, and delegation...：这个选项涉及代表性（delegation），这并不是用户供应的核心要素，同时“激活”不是传统意义上的供应的关键环节。

3. C. The maintenance of user objects...：这个描述仅限于“维护”阶段，不涵盖创建和停用，这样就不完整。

4. D. The creation and deactivation of user objects...：类似于 C 选项，这也缺少了维护的环节。

综上所述，选项 A 是最佳答案，因为它完整地描述了用户供应的过程，包括创建、维护和停用用户对象及其属性。

在CISSP的考试中，不能再按照以往的考试经验，选择描述最详细的选项，或者按照直觉/常识进行选择的选项；每个题目都需要仔细的阅读题目，理解题目作者的出题角度以及想要考察的内容知识点，并站在安全从业者专业的角度，从4个选项中选出最符合问题描述情境的最优答案。

一些问题的选项并没有绝对的对错，并且很多题目都存在着“陷阱”的情况，这个是CISSP考试的难点（我理解的），就是低容错率+庞大的知识体系，在面对模棱两可的两个答案的时候，应该回去认真读题，回忆对应的知识点，再根据安全从业者的角度，审视全局，选择最符合题目的答案。