Читаем CISSP Practice полностью

A software product displays quality to the extent that all aspects of the customer’s requirements are satisfied. This means that quality is built into the product during its development process rather than inspected at the end. It is too late to inspect the quality when the product is already built. Most assurance is provided when the needs are fully understood, captured, and transformed (designed) into a software product.

80. From a security risk viewpoint, the job duties of which one of the following should be fully separated from the others?

a. System administrator

b. Security administrator

c. Computer operator

d. System programmer

80. c. Separation of duties is a security principle that divides critical functions among different employees in an attempt to ensure that no one employee has enough information or access privileges to perpetrate damaging fraud or conduct other irregularities such as damaging data and/or programs.

The computer operator‘s job duties should be fully and clearly separated from the others. Due to concentration of risks in one job and if the computer operator’s job duties are not fully separated from other conflicting job duties (for example, system administrator, security administrator, or system programmer), there is a potential risk that the operator can issue unprivileged commands from his console to the operating system, thus causing damage to the integrity of the system and its data. In other words, the operator has full access to the computer in terms of running the operating system, application systems, special program, and utility programs where the others do not have such full access. It is good to limit the computer operator’s access to systems and their documentation, which will help him in understanding the inner working of the systems running on the computer. At the same time it is good to limit the others’ access to the computer systems just enough to do their limited job duties.

81. In maintenance, which of the following is most risky?

a. Local maintenance

b. Scheduled maintenance

c. Nonlocal maintenance

d. Unscheduled maintenance

81. c. Nonlocal maintenance work is conducted through either an external network (mostly through the Internet) or an internal network. Because of communicating across a network connection, nonlocal maintenance work is most risky. Local maintenance work is performed without communicating across a network connection. For local maintenance, the vendor brings the hardware and software into the IT facility for diagnostic and repair work, which is less risky. Local or nonlocal maintenance work can be either scheduled or unscheduled.

82. The IT operations management of RDS Corporation is concerned about how to increase its data storage capacity to meet its increased growth in business systems. Based on a storage management consultant’s report, the RDS management is planning to install redundant array of independent disks 6 (RAID6), which is a block-level striping with double distributed parity system to meet this growth. If four disks are arranged in RAID6 where each disk has a storage capacity of 250GB, and if space efficiency is computed as [1-(2/n)] where “n” is the number of disks, how much of this capacity is available for data storage purposes?

a. 125GB

b. 250GB

c. 375GB

d. 500GB

82. d. The RAID6 storage system can provide a total of 500GB of usable space for data storage purposes. Space efficiency represents the fraction of the sum of the disks’ capacities that is available for use.

Space efficiency = [1−(2/n)] = [1−(2/4)] = 1−0.5= 0.5

Total available space for data storage = 0.5 × 4 × 250 = 500GB

83. In redundant array of independent disks (RAID) technology, when two drives or disks have a logical joining, it is called:

a. Disk concatenation

b. Disk striping

c. Disk mirroring

d. Disk replication