Free ISC2 CSSLP Exam Dumps July 2026

ISO 27004 is an information security standard developed by the International Organization for Standardization (ISO) and the International

Electrotechnical Commission (IEC). It is entitled as 'Information technology - Security techniques - Information security management -

Measurement'. The ISO 27004 standard provides guidelines on specifications and use of measurement techniques for the assessment of the

effectiveness of an implemented information security management system and controls. It also helps an organization in establishing the

effectiveness of ISMS implementation, embracing benchmarking, and performance targeting within the PDCA (plan-do-check-act) cycle.

Answer A is incorrect. ISO 27003 is entitled as 'Information Technology - Security techniques - Information security management

system implementation guidance'.

Answer B is incorrect. ISO 27005 is entitled as 'ISO/IEC 27005:2008 Information technology -- Security techniques -- Information

security risk management'.

Answer D is incorrect. ISO 27006 is entitled as 'Information technology - Security techniques - Requirements for bodies providing audit

and certification of information security management systems'.

Teardrop is an attack with IP fragments that cannot be reassembled. In this attack, corrupt packets are sent to the victim's computer by using

IP's packet fragmentation algorithm. As a result of this attack, the victim's computer might hang.

Answer D is incorrect. Smurf is an ICMP attack that involves spoofing and flooding.

Answer C is incorrect. Dictionary attack is a type of password guessing attack. This type of attack uses a dictionary of common words to

find out the password of a user. It can also use common words in either upper or lower case to find a password. There are many programs

available on the Internet to automate and execute dictionary attacks.

Answer A is incorrect. A password guessing attack occurs when an unauthorized user tries to log on repeatedly to a computer or

network by guessing usernames and passwords. Many password guessing programs that attempt to break passwords are available on the

Internet. Following are the types of password guessing attacks:

Brute force attack

Dictionary attack

According to U.S. Department of Defense (DoD) Instruction 8500.2, there are eight Information Assurance (IA) areas, and the controls are

referred to as IA controls. Following are the various U.S. Department of Defense information security standards:

DC Security Design & Configuration

IA Identification and Authentication

EC Enclave and Computing Environment

EB Enclave Boundary Defense

PE Physical and Environmental

PR Personnel

CO Continuity

VI Vulnerability and Incident Management

Answer B is incorrect. Business continuity management is an International information security standard.

User data constraint is a security constraint element summarized in the Java Servlet Specification 2.4. It sets up a requirement to receive the

constrained requests over a protected layer connection, such as TLS (Transport Layer Security). The user data constraint offers guarantee

(NONE, INTEGRAL, and CONFEDENTIAL) for the transportation of data between client and server. If a request does not have user data

constraint, the container accepts the request after it is received on a connection.

Answer C is incorrect. Web resource collection is a set of URL patterns and HTTP operations that define all resources required to be

protected. It is a security constraint element summarized in the Java Servlet Specification v2.4. The Web resource collection includes the

following elements:

URL patterns

HTTP methods

Answer B is incorrect. Authorization constraint is a security constraint element summarized in the Java Servlet Specification 2.4. It sets

up a requirement for authentication and names the authorization roles that can access the URL patterns and HTTP methods as defined by the

security constraint. In the absence of a security constraint, the container accepts the request without requiring any user authentication. If no

authorization role is specified in the authorization constraint, the container cannot access constrained requests. The wildcard character '*'

specifies all authorization role names that are defined in the deployment descriptor.

Answer D is incorrect. It is not a security constraint element.

Microsoft software security expert Michael Howard defines the following heuristics for determining code review in 'A Process for Performing

Security Code Reviews':

Old code: Newer code provides better understanding of software security and has lesser number of vulnerabilities. Older code must be

checked deeply.

Code that runs by default: It must have high quality, and must be checked deeply than code that does not execute by default. Code

that runs by default increases the application's attack surface.

Code that runs in elevated context: It must have higher quality. Code that runs in elevated privileges must be checked deeply and

increases the application's attack surface.

Anonymously accessible code: It must be checked deeply than code that only authorized users and administrators can access, and it

increases the application's attack surface.

Code listening on a globally accessible network interface: It must be checked deeply for security vulnerabilities and increases the

application's attack surface.

Code written in C/C++/assembly language: It is prone to security vulnerabilities, for example, buffer overruns.

Code with a history of security vulnerabilities: It includes additional vulnerabilities except concerted efforts that are required for

removing them.

Code that handles sensitive data: It must be checked deeply to ensure that data is protected from unintentional disclosure.

Complex code: It includes undiscovered errors because it is more difficult to analyze complex code manually and programmatically.

Code that changes frequently: It has more security vulnerabilities than code that does not change frequently.

Software:

1.Security requirements derivation/elicitation and specification

2.Security risk assessment

3.Secure architecture and design

4.Secure implementation

5.Security testing

6.Security assurance

The following concepts represent the three fundamental principles of information security:

1.Confidentiality

2.Integrity

3.Availability

Answer B is incorrect. Privacy, authentication, accountability, authorization and identification are also concepts related to information

security, but they do not represent the fundamental principles of information security.