ISC2 CSSLP Exam - Topic 5 Question 79 Discussion

Actual exam question for ISC2's CSSLP exam

Question #: 79
Topic #: 5

[All CSSLP Questions]

Which of the following techniques is used to identify attacks originating from a botnet?

APassive OS fingerprinting

BRecipient filtering

CIFilter

DBPF-based filter

Show Suggested Answer

Suggested Answer: A

The Recovery Point Objective (RPO) describes the acceptable amount of data loss measured in time. It is the point in time to which data must

be recovered as defined by the organization. The RPO is generally a definition of what an organization determines is an 'acceptable loss' in a

disaster situation. If the RPO of a company is 2 hours and the time it takes to get the data back into production is 5 hours, the RPO is still 2

hours. Based on this RPO the data must be restored to within 2 hours of the disaster.

Answer B is incorrect. The Recovery Time Objective (RTO) is the duration of time and a service level within which a business process

must be restored after a disaster or disruption in order to avoid unacceptable consequences associated with a break in business continuity. It

includes the time for trying to fix the problem without a recovery, the recovery itself, tests and the communication to the users. Decision time

for user representative is not included. The business continuity timeline usually runs parallel with an incident management timeline and may

start at the same, or different, points.

In accepted business continuity planning methodology, the RTO is established during the Business Impact Analysis (BIA) by the owner of a

process (usually in conjunction with the Business Continuity planner). The RTOs are then presented to senior management for acceptance.

The RTO attaches to the business process and not the resources required to support the process.

Answer D is incorrect. The Recovery Time Actual (RTA) is established during an exercise, actual event, or predetermined based on

recovery methodology the technology support team develops. This is the time frame the technology support takes to deliver the recovered

infrastructure to the business.

Answer C is incorrect. The Recovery Consistency Objective (RCO) is used in Business Continuity Planning in addition to Recovery Point

Objective (RPO) and Recovery Time Objective (RTO). It applies data consistency objectives to Continuous Data Protection services.

by Marge at Jan 28, 2024, 08:14 PM

Limited Time Offer

25%

Off

Get Premium CSSLP Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Reita

4 months ago

I thought IFilter was more for document searching, not attacks.

upvoted 0 times

...

Frederica

5 months ago

Recipient filtering? Not sure that’s effective against botnets.

upvoted 0 times

...

Filiberto

5 months ago

Wait, is Passive OS fingerprinting even related to botnets?

upvoted 0 times

...

Britt

5 months ago

Totally agree, it’s great for identifying botnet traffic!

upvoted 0 times

...

Billy

5 months ago

I think BPF-based filter is the right choice.

upvoted 0 times

...

Eun

6 months ago

I don't remember much about IFilter, but it doesn't sound like it would help with identifying botnet attacks.

upvoted 0 times

...

Marlon

6 months ago

I feel like BPF-based filters could be the right answer since they are often used for network traffic analysis.

upvoted 0 times

...

Kate

6 months ago

I remember practicing with questions about filtering techniques, but I can't recall if recipient filtering applies here.

upvoted 0 times

...

Zoila

6 months ago

I think passive OS fingerprinting might be related, but I'm not entirely sure if it's specifically for botnets.

upvoted 0 times

...

Pamella

6 months ago

This is a good question to test our knowledge of botnet detection methods. I'm going to carefully consider each option and try to eliminate the ones that don't seem relevant.

upvoted 0 times

...

Stefany

6 months ago

I'm a bit confused by the options here. I'll need to make sure I understand the differences between these techniques before selecting an answer.

upvoted 0 times

...

Alverta

6 months ago

Okay, I think I know the answer to this. Passive OS fingerprinting is used to identify the operating systems of devices in a network, which can help detect bots that are part of a botnet.

upvoted 0 times

...

Franchesca

6 months ago

This seems like a tricky question. I'll need to think carefully about the different techniques used to identify botnet attacks.

upvoted 0 times

...

Dierdre

6 months ago

Hmm, I'm not totally sure about this one. I'll have to review my notes on network security and see if I can recall the specific techniques for detecting botnets.

upvoted 0 times

...

Eugene

6 months ago

Hmm, I'm not totally sure about the differences between a Virtual Log Collector and a lockbox. I'll need to think this through carefully.

upvoted 0 times

...

Quentin

6 months ago

Hmm, I'm a little unsure about this one. I'll have to think it through carefully. Maybe I should review my notes on contract law before deciding.

upvoted 0 times

...

Margo

6 months ago

I think we had a similar question in practice about correct IP addressing, but I'm confused about what the subnet mask should be.

upvoted 0 times

...

Merissa

11 months ago

BPF-based filter, huh? Sounds like a fancy way to say 'We're gonna put a net over the whole network and see what crawls in.'

upvoted 0 times

Viola

9 months ago

It's a proactive approach to identifying and blocking potential threats.

upvoted 0 times

...

Floyd

10 months ago

I think it's more about analyzing network traffic to detect patterns of botnet activity.

upvoted 0 times

...

Jackie

10 months ago

Yeah, it's like a filter that catches suspicious activity from botnets.

upvoted 0 times

...

Ettie

11 months ago

Hmm, Passive OS fingerprinting sounds like the most logical choice here. I mean, who doesn't love a good ol' game of 'Guess the Botnet's Operating System'?

upvoted 0 times

Iluminada

10 months ago

Recipient filtering might not be as useful as Passive OS fingerprinting in this case.

upvoted 0 times

...

Michael

10 months ago

I think BPF-based filter could also be effective in detecting botnet activity.

upvoted 0 times

...

Tamra

10 months ago

Passive OS fingerprinting is a good choice for identifying botnet attacks.

upvoted 0 times

...

Kirk

11 months ago

IFilter? Isn't that some kind of text indexing tool? I don't see how that would help identify botnet attacks. Definitely going with A, Passive OS fingerprinting.

upvoted 0 times

Bambi

10 months ago

C) IFilter is indeed a text indexing tool, not related to identifying botnet attacks.

upvoted 0 times

...

Micah

10 months ago

B) Recipient filtering is more for email security, not really for botnet detection.

upvoted 0 times

...

Willard

11 months ago

A) Passive OS fingerprinting is a common technique used to identify botnet attacks.

upvoted 0 times

...

Elenora

12 months ago

Recipient filtering? That sounds more like a spam prevention technique. I'm going with D, BPF-based filter. It's designed to filter network traffic, which is crucial for botnet detection.

upvoted 0 times

...

Joye

12 months ago

I'm pretty sure it's Passive OS fingerprinting. Botnet attacks usually involve infected machines, and identifying their OS can help detect the attack pattern.

upvoted 0 times