difficult ques 2

[CISSP_Candidate]

Q1. Lock picking is classified under which one of the following lock mechanism attacks?

A. Illicit key
B. Circumvention
C. Manipulation
D. Shimming

Answer: D ??? ( http://en.wikipedia.org/wiki/Shim )

Q2. Type II errors occur when which one of the following biometric system rates is high?

A. False accept rate
B. False reject rate
C. Crossover error rate
D. Speed and throughput rate

Answer: A is correct (but also C ...)

Q3. Which one of the following is a TRUE statement about the bottom three layers of the Open Systems Interconnection (OSI) Reference Model?

A. They generally pertain to the characteristics of the communicating end systems.
B. They cover synchronization and error control of network data transmissions.
C. They support and manage file transfer and distribute process resources.
D. They support components necessary to transmit network messages.

Answer: I would say A but not sure

Q4. Virtual Private Network (VPN) software typically encrypts all of the following EXCEPT

A. file transfer protocol.
B. data link messaging.
C. HTTP protocol.
D. session information.

Answer: B i believe, since ARP/RARP cannot be encrypted

Q5. Program change controls must ensure that all changes are

A. audited to verify intent.
B. tested to ensure correctness.
C. implemented into production systems.
D. within established performance criteria.

Answer: B ???

Q6. Which one of the following is an important characteristic of an information security policy?

A. Identifies major functional areas of information
B. Quantifies the effect of the loss of the information
C. Requires the identification of information owners
D. Lists applications that support the business function

Answer: I hesitate between A and C

[Jescoi]

Nice questions. My thought process:

Q1. C. Since the question doesn't specifically state it is a key-based lock I would go with manipulation of the lock, tumblers, device to circumvent it.

Q2. A. The false acceptance rate is a Type II error. The CER is the % where the FAR equals the FRR.

Q3. D. I'm guessing on this one as the wording seems odd to me for some reason. Thought process: the bottom three layers of the OSI support the upper layers in transmission of network information and is the interface to the network.

Q4. B.

Q5. A. (looks best to me) Program change should be audited to verify what is actually being changed. A trapdoor could be placed in that would be missed by testing but should be caught in the audit.

Q6. C (again looks best to me) Knowledge of who the information owners would provide more information for a infosec policy rather than the functional areas. I.e. Joe in Finance can help with policy creation where identifying finance as a major functional area doesn't provide enough details of what/who/when in Finance needs to be included in an infosec program.