Transcender :: Question of the Day

Today's Question

Taken from Cert-CAPM3ED
Related Exam: PMI Cert-CAPM3ED PMCert: Certified Associate in Project Management Third Edition
Item Number: Cert-CAPM3ED.6.19.8

For which risks would it be MOST important to develop risk response plans?

all risks with a high impact to the project

risks with a high probability and high impact

risks with a high probability and medium impact

risks that have been deemed as certain to occur on the project

Previous question and answer:

Taken from Cert-CISSP
Related Exam: ISC2 Cert-CISSP SecurityCert: CISSP
Item Number: Cert-CISSP.4.3.11

Recently, an application patch that included malware was installed on a computer. After the problem occurred, you investigated the patch's origin, and found that the patch was not downloaded from the application vendor's Web site. You need to ensure that future patches are from reputable sources and do not contain any malware.

What is the best way to do this?

Scan the patch file for viruses.
Perform an integrity check using a digital signature.
Scan the patch file for malware.
Install the patch file on a test computer.

The best way to ensure that future patches are from reputable sources and do not contain malware is to perform an integrity check using a digital signature. Digital signatures are created by a hash algorithm. When you calculate the digital signature, you should compare the signature to the one provided by the vendor. If the signature does not match, the file has been compromised. If the signature matches, the file is safe to be installed.

Scanning the patch file for viruses or malware will only ensure that viruses or malware are detected and removed from the patch. It will not ensure that the patch is from a reputable source. In addition, depending on the status of your virus scanner and malware scanner, you may not detect newer viruses or malware.

You should not install a patch file on a test computer until you have verified that the patch is from a reputable source. Installing a patch file on a test computer allows you to test the functionality of the patch before deploying to a live environment. This is a good practice to ensure that the patch does not cause undesired consequences.

References:

CISSP Certification All-in-One Exam Guide, Chapter 11: Application Security, Patch Management, Step 2: Research, p. 1028

Previous Questions
Today
06/17/2013
06/14/2013
06/13/2013
06/12/2013
06/11/2013
06/10/2013
06/07/2013
06/06/2013
06/05/2013
06/04/2013
06/03/2013
05/31/2013
05/30/2013
05/29/2013
05/28/2013
05/27/2013
05/24/2013
05/23/2013
05/22/2013
05/21/2013
05/20/2013