CSSLP Exam Dumps and Practice Questions

Benchmarking is the tool used by system assessment process to provide a point of

reference by which performance measurements can be reviewed with respect to other organizations.

Benchmarking is also recognized as Best Practice Benchmarking or Process Benchmarking. It is a process used in management and mostly

useful for strategic management. It is the process of comparing the business processes and performance metrics including cost, cycle time,

productivity, or quality to another that is widely considered to be an industry standard benchmark or best practice. It allows organizations to

develop plans on how to implement best practice with the aim of increasing some aspect of performance.

Benchmarking might be a one-time event, although it is frequently treated as a continual process in which organizations continually seek out

to challenge their practices. It allows organizations to develop plans on how to make improvements or adapt specific best practices, usually

with the aim of increasing some aspect of performance.

Answer C is incorrect. The ISO 9001:2000 standard combines the three standards 9001, 9002, and 9003 into one, called 9001. Design

and development procedures are required only if a company does in fact engage in the creation of new products. The 2000 version sought to

make a radical change in thinking by actually placing the concept of process management front and center ('Process management' was the

monitoring and optimizing of a company's tasks and activities, instead of just inspecting the final product).

The ISO 9001:2000 version also demands involvement by upper executives, in order to integrate quality into the business system and avoid

delegation of quality functions to junior administrators. Another goal is to improve effectiveness via process performance metrics numerical

measurement of the effectiveness of tasks and activities. Expectations of continual process improvement and tracking customer satisfaction

were made explicit.

Answer B is incorrect. Six Sigma is a business management strategy, initially implemented by Motorola. As of 2009 it enjoys widespread

application in many sectors of industry, although its application is not without controversy.

Six Sigma seeks to improve the quality of process outputs by identifying and removing the causes of defects and variability in manufacturing

and business processes. It uses a set of quality management methods, including statistical methods, and creates a special infrastructure of

people within the organization ('Black Belts', 'Green Belts', etc.) who are experts in these methods. Each Six Sigma project carried out within

an organization follows a defined sequence of steps and has quantified financial targets (cost reduction or profit increase). The often used Six

Sigma symbol is as follows:

Answer D is incorrect. Capability Maturity Model Integration (CMMI) was created by Software Engineering Institute (SEI). CMMI in

software engineering and organizational development is a process improvement approach that provides organizations with the essential

elements for effective process improvement. It can be used to guide process improvement across a project, a division, or an entire

organization. CMMI can help integrate traditionally separate organizational functions, set process improvement goals and priorities, provide

guidance for quality processes, and provide a point of reference for appraising current processes. CMMI is now the de facto standard for

measuring the maturity of any process. Organizations can be assessed against the CMMI model using Standard CMMI Appraisal Method for

Process Improvement (SCAMPI).

The principle duties performed by the BIOS during POST (power-on-self-test) are as follows:

It verifies the integrity of the BIOS code itself.

It discovers size and verifies system memory.

It discovers, initializes, and catalogs all system hardware.

It delegates control to other BIOS if it is required.

It provides a user interface for system's configuration.

It identifies, organizes, and selects boot devices.

It executes the bootstrap program.

Answer F is incorrect. The BIOS does not interrupt the execution of all running programs.

The Chinese Wall Model is the basic security model developed by Brewer and Nash. This model prevents information flow that may cause a

conflict of interest in an organization representing competing clients. The Chinese Wall Model provides both privacy and integrity for data.

Answer D is incorrect. The Biba model is a formal state transition system of computer security policy that describes a set of access

control rules designed to ensure data integrity. Data and subjects are grouped into ordered levels of integrity. The model is designed so that

subjects may not corrupt data in a level ranked higher than the subject, or be corrupted by data from a lower level than the subject.

Answer C is incorrect. The Clark-Wilson model provides a foundation for specifying and analyzing an integrity policy for a computing

system. The model is primarily concerned with formalizing the notion of information integrity. Information integrity is maintained by preventing

corruption of data items in a system due to either error or malicious intent.

The model's enforcement and certification rules define data items and processes that provide the basis for an integrity policy. The core of the

model is based on the notion of a transaction.

Answer A is incorrect. The Bell-La Padula Model is a state machine model used for enforcing access control in government and military

applications. The model is a formal state transition model of computer security policy that describes a set of access control rules which use

security labels on objects and clearances for subjects. Security labels range from the most sensitive (e.g.,'Top Secret'), down to the least

sensitive (e.g., 'Unclassified' or 'Public').

The Bell-La Padula model focuses on data confidentiality and controlled access to classified information, in contrast to the Biba Integrity Model

which describes rules for the protection of data integrity.

NIST SP 800-26 (Security Self-Assessment Guide for Information Technology Systems) provides a guideline on questionnaires and checklists

through which systems can be evaluated for compliance against specific control objectives.

Answer A, E, C, D, and F are incorrect. NIST has developed a suite of documents for conducting Certification & Accreditation (C&A).

These documents are as follows:

NIST Special Publication 800-37: This document is a guide for the security certification and accreditation of Federal Information

Systems.

NIST Special Publication 800-53: This document provides a guideline for security controls for Federal Information Systems.

NIST Special Publication 800-53A. This document consists of techniques and procedures for verifying the effectiveness of security

controls in Federal Information System.

NIST Special Publication 800-59: This document is a guideline for identifying an information system as a National Security System.

NIST Special Publication 800-60: This document is a guide for mapping types of information and information systems to security

objectives and risk levels.

The Bell-La Padula model is a state machine model used for enforcing access control in large organizations. It focuses on data confidentiality

and access to classified information, in contrast to the Biba Integrity model, which describes rules for the protection of data integrity. In the

Bell-La Padula model, the entities in an information system are divided into subjects and objects.

The Bell-La Padula model is built on the concept of a state machine with a set of allowable states in a computer network system. The

transition from one state to another state is defined by transition functions. The model defines two mandatory access control (MAC) rules and

one discretionary access control (DAC) rule with three security properties:

1.The Simple Security Property: A subject at a given security level may not read an object at a higher security level (no read-up).

2.The *-property (star-property): A subject at a given security level must not write to any object at a lower security level (no write-

down). The *-property is also known as the Confinement property.

3.The Discretionary Security Property: It uses an access matrix to specify the discretionary access control.