Practice Test(DOMAIN7)

CISSP総合学習サイト

Domain 7 Exam.

A minimum of 70% is required to pass.

 

Results

Wonderful!

There may be content you haven’t seen yet.

#1. Which formulas are used in a Business Impact Analysis (BIA) assessment?

#2. Which of the following is the average time it takes to fix and return a broken device?

〇:MTTR

Mean Time to Repair (MTTR) is the average time it takes to repair a device and return it to pre-failure production. Using a redundant array as an example, MTTR is the time it takes to replace the failed drive after the actual failure is noticed and the time the redundant array has completed rewriting the information on the new drive. Therefore, the correct answer is MTTR.

 

×:SLA

Service Level Agreements (SLA) are agreements on service quality, such as usage volume and failure recovery.

 

×:Hot Swap

Hot swapping refers to replacing, attaching, or disconnecting parts, cables, etc. while equipment is still in operation.

 

×:MTBF

Mean Time Between Failures (MTBF) is the average time it takes for a device to fail after repair.

#3. In a redundant array in a RAID system, data and parity information is striped across several different disks. What is parity information?

〇:Information used to reconstruct data

RAID can improve system performance by providing fault tolerance to the hard drive and the data it holds. Redundancy and speed are provided by splitting the data and writing it to multiple disks, allowing different disk heads to operate simultaneously to retrieve the requested information. Control data is also distributed across each disk. This is called parity, and if one disk fails, the other disks can work together to recover the data.

 

×:Information used to create new data

This is incorrect because parity information is not used to create new data, but rather as instructions on how to recreate lost or corrupted data.

 

×:Information used to erase data

Parity information is not used to erase data. This is incorrect because it is used as instructions on how to recreate lost or corrupted data.

 

×:Information used to construct data

Parity information is not used to create data. Incorrect because it is used as instructions on how to recreate lost or corrupted data.

#4. You are selecting a site for a new data center and offices. Which of the following is not a valid security concern?

Greenfield is undeveloped land that has not yet been built upon. The perspectives for selecting a site as a data center site include topography, utilities, and public safety.

  • Topography refers to the physical shape of the landscape-hills, valleys, trees, streams.
  • Utility refers to the degree to which power and internet in the area are reliable.
  • Public safety is in terms of how high is the crime rate in the area and how close is the police force.

#5. Different levels of RAID determine the type of activity that occurs within a RAID system. Which level of RAID is associated with byte-level parity?

〇:RAID Level 3

RAID redundant arrays provide fault tolerance capability for hard drives and can improve system performance. Redundancy and speed are provided by splitting data and writing it to multiple disks, allowing different disk heads to operate simultaneously to retrieve requested information. At this time, recovery data is also created. This is called parity; if one disk fails, the parity data can be used to reconstruct the corrupted or lost information. Different levels of RAID systems experience different activities that provide fault tolerance or improved performance. RAID level 3 is a method that uses byte-level striping and dedicated parity disks.

 

×:RAID Level 0

Wrong because only striping occurs at level 0.

 

×:RAID Level 5

RAID 5 is incorrect because it uses block-level striping and interleaved parity on all disks.

 

×:RAID Level 10

Level 10 is incorrect because it is associated with striping and mirroring.

#6. Which of the following adequately describes parallel testing in disaster recovery testing?

〇:Ensure that some systems are executed at the alternate site.

Parallel testing compares how some systems run at the alternate site and how the results are processed at the primary site. This is to assure that systems run at the alternate site and does not affect service productivity.

 

×:All departments will be sent a copy of the disaster recovery plan for completeness.

This alternative is incorrect because it describes a checklist test.

 

×:Representatives from each department meet to validate the plan.

This option is incorrect because it describes a structured walk-through test.

 

×:The normal operation system is taken down.

This option is incorrect because it describes a full interruption test.

#7. We have been paying a software vendor to develop software on a custom basis, but that vendor may be out of business. Since it does not have access to the code, it cannot be retained. In what ways can the company prevent this?

〇:Software Escrow

If you do not have access to the software, but the developer may be out of business, you should plan for what to do after that out-of-business event. Software escrow means that the third party retains the source and compiled code, backup manuals, and other support materials. The agreement between the software vendor, the customer, and the third party would typically be that the customer would only have access to the source code when the vendor goes out of business and in the event of the vendor’s inability to fulfill its stated responsibilities or breach of the original agreement. The customer is protected because they can gain access to the source code and other materials through a third-party escrow agent.

 

×:Reciprocal Treatment Agreement

Although the term “reciprocal treatment agreement” does not exist, a close concept is mutual assistance agreements. A Mutual Assistance Agreement (MAA) is a promise to support each other in the event of a disaster by sharing facilities. There are times when you want to do something about a disaster, but you don’t have the funds to do it. In such a case, you can find a similar organization and agree to cooperate with each other in the event of a disaster.

 

×:Electronic Data Vault

Electronic data vaulting (e-vaulting) is the use of a remote backup service to electronically transmit backups off-site at regular intervals or when files are changed.

 

×:Business interruption insurance

Although the term business interruption insurance does not exist, it can be interpreted as a concept similar to insurance in the event of business interruption. Insurance is typically applied against financial risk. In this issue, software escrow is more appropriate because we want to continue access to the software.

#8. After a disaster has occurred, an impact assessment must be performed. Which of the following steps is the last one performed in an impact assessment?

〇:Declare the impact and consequences of the disaster.

The final step in the damage assessment is to declare the disaster. After the information from the damage assessment has been collected and evaluated, determine if the BCP actually needs to be activated. The BCP coordinator and team should determine the activation criteria before the disaster occurs.

 

×:Determine the cause of the disaster.

Determining the cause of the disaster is incorrect as it is the first step in the damage assessment process.

 

×:Identify resources that need to be replaced immediately.

Incorrect because identifying resources that need to be replaced immediately is not the last step in damage assessment.

 

×:Determine how long it will take to bring critical functions back online.

Incorrect because determining how long it will take to bring critical functions back online is the second-to-last step in damage assessment.

#9. What is remote journaling as part of a fault tolerance strategy?

Remote journaling means that a transaction log file, not the file itself, is sent remotely. A transaction is one or more update operations performed on a file. In other words, it is a history of updates to a file. This means that if the original file is lost, it can be reconstructed from the transaction log.

#10. Which of the following is NOT a phase of the Disaster Recovery Planning life cycle?

Disaster Recovery Planning includes the Mitigation, Preparedness, Response, and Recovery life cycles.

  • Mitigation: Reduces the impact and likelihood of a disaster.
  • Prepare: Create programs, procedures, and tools for response.
  • Response: follow procedures and how to respond to a disaster.
  • Recovery: re-establish basic functionality and return to a full production environment.

#11. The Recovery Time Objective (RTO) and the Maximum Tolerable Downtime (MTD) metric have similar roles, but their values are defined differently. Which of the following best describes the difference between RTO and MTD metrics?

MTD represents the time it takes to signify severe and irreparable damage to the reputation and bottom line of an organization; RTO values are smaller than MTD values; RTO assumes that there is a period of acceptable downtime.

#12. John provides a weekly report to the manager outlining security incidents and mitigation procedures. If there is no incident information to put on the report, what action should he take?

〇:Send a report labeled “No output”.

If there is nothing to report (nothing to report), you need to make sure the manager is aware that the report has no information and is not only to be held accountable.

 

×:Send an email notifying the manager that there is nothing to report.

It is not appropriate to suddenly keep a record of the report by e-mail, since the report is normally scheduled to be reported in the operation. Realistically, wouldn’t you be more endearing to your manager if you communicated with him or her every step of the way? No, I am not asking you to do that.

 

×:Re-submit last week’s report and submit the date of last week’s report as this week’s date.

Delivering last week’s report does not express that nothing was reported this week.

 

×:Nothing.

You are required to report that nothing happened.

#13. Measuring the damage and recovery requirements by different indicators helps quantify the risk. which is correct about the RPO (Recovery Point Objective) and RTO (Recovery Time Objective)?

RPO (Recovery Point Objective) is the target value for recovering data at a point in the past when a failure occurs. When a failure occurs, the data currently handled is lost. The lost data must be recovered from backups, but it is important to know how far in the past the backups are from the current point in time.

RTO (Recovery Time Objective) is a target value that defines when the data should be recovered in the event of a failure. In the event of a failure, the service must not be unavailable indefinitely. Failure response procedures and disaster drills must be implemented to establish a target value for the time from the occurrence of a failure to the startup of service.

#14. Which of the following is not a common component as a step to change configuration management?

A structured change management process must be established to direct staff to make appropriate configuration changes. Standard procedures keep the process under control and ensure that it can be implemented in a predictable manner. Change management policies should include procedures for requesting changes, approving changes, documenting, testing and viewing changes, implementing, and reporting changes to management. The configuration management change control process is not typically associated with service level agreement approvals.

#15. Which of the following plans would you use to organize information about specific system hardware?

Disaster Recovery Planning (DRP) is the process of creating short-term plans, policies, procedures, and tools to enable the recovery or continuation of critical IT systems in the event of a disaster. It focuses on the IT systems that support critical business functions and how they will be restored after a disaster. For example, it considers what to do if you suffer a distributed denial of service (DDOS) attack, if your servers are compromised, if there is a power outage, etc. BCP is more focused on what should happen and does not necessarily include system requirements.

#16. Which RAID configuration always provides redundancy?

Disk mirroring means writing the same data to multiple hard disks; a RAID (Redundant Array of Independent Disks) controller must write all data twice, requiring at least two disks. Disk striping can also be provided when parity is used, but disk striping alone cannot provide redundancy.

#17. RAID systems are available in a variety of methods that provide redundancy and performance. Which ones write data divided across multiple drives?

〇:Striping

RAID redundant arrays is a technology used for redundancy and performance. It combines multiple physical disks and aggregates them into a logical array; RAID appears as a single drive to applications and other devices. With striping, data is written to all drives. With this activity, data is split and written to multiple drives. Since multiple heads are reading and writing data at the same time, write and read performance is greatly improved.

 

×:Parity

Parity is used to reconstruct corrupted data.

 

×:Mirroring

Writing data to two drives at once is called mirroring.

 

×:Hot Swap

Hot swap refers to a type of disk found on most RAID systems. A RAID system with hot-swap disks allows the drives to be swapped out while the system is running. When a drive is swapped out or added, parity data is used to rebuild the data on the new disk that was just added.

#18. Which of the following is a structured walk-through test in disaster recovery testing?

〇:Representatives from each department meet and undergo validation.

Structured walk-through testing allows functional personnel to review the plan as it is fulfilled to ensure its accuracy and validity.

 

×:Ensures that some systems will run at alternate sites.

This is incorrect because it describes parallel testing.

 

 

×:Send a copy of the disaster recovery plan to all departments to verify its completeness.

This is incorrect because it describes a checklist test.

 

×:Take down the normal operation system.

This is incorrect because it describes a full interruption test.

#19. The team should be involved in the implementation of the business continuity plan. Which team is responsible for initiating recovery of the original site?

〇:Salvage Teams

The BCP coordinator should understand the needs of the company and the types of teams that need to be developed and trained. Employees should be assigned to specific teams based on their knowledge and skill sets. Named leaders, each team must have members and the ability to direct their activities. These team leaders will be responsible not only for ensuring that team goals are met, but also for interacting with each other to ensure that each team is operating properly. The salvage team is responsible for initiating recovery of the original site. They are also responsible for backing up data from the alternate site and restoring it within the new facility, carefully terminating any unforeseen operations, and ensuring equipment and personnel are transported to the new facility.

 

×:Damage Assessment Team

The Damage Assessment Team is incorrect because it is responsible for determining the extent and severity of damage.

 

×:BCP Team

Wrong because the BCP team is responsible for creating and maintaining a business continuity plan.

 

×:Recovery Team

Wrong because the Recovery Team is responsible for getting an alternate site to work and to keep the environment functioning.

#20. Which of the following technologies can be used to logically combine physically disparate groups of systems and help provide immunity to failure while also helping with scalability?

〇:Clustering

Clustering is a fault-tolerant server technology in which servers are redundantly analogous. A server cluster is a group of servers that can be logically interpreted by users as one server and managed as a single logical system. Clustering provides availability and scalability. It helps to provide immunity to this group, physically distinct systems and failure and improved performance.

The problem statement is phrased in a difficult sentence. It would be difficult to derive the exact specific words from the phrase “logically coupled with a physically distinct group of systems.” In such questions, it is useful to use a process of elimination to derive options from the words that would be the point of the question. From the latter part, “technology that helps provide immunity to failure while also helping with scalability,” we can see that it is something that is both fault-tolerant and scalable. Fault tolerance alone does not narrow down the choices, but in terms of scalability features, clustering falls into this category. Therefore, the correct answer is “clustering.

 

×:Disk dupe

There is no such term. When presented with a seemingly incomprehensible sentence, you may consider the possibility that it is a word you probably do not know, given the time limit.

 

×:RAID

RAID (Redundant Array of Independent/Inexpensive Disks) is a technology for operating multiple hard disks as a single hard disk. It has a mechanism to improve physical redundancy by how the data to be recorded is written to the hard disks. This is not a technology system that ensures scalability.

 

×:Virtualization

Virtualization is a technology that makes it appear as if multiple operating systems are running on the system. Or, it is an environment that enables the construction of a real environment through simulation-like operations surrounding them. While virtualized environments allow for the construction of environments that provide fault tolerance and scalability, they do not match the operation of logically combining them with physically different groups of systems.

Previous
終了