Which of the following actions will reduce risk to a laptop before traveling to a high risk area?

Examine the device for physical tampering

Implement more stringent baseline configurations

Purge or re-image the hard disk drive

Which of the following represents the GREATEST risk to data confidentiality?

Backup tapes are generated unencrypted

Network redundancies are not implemented

Security awareness training is not completed

Backup tapes are generated unencrypted

Users have administrative privileges

What is the MOST important consideration from a data security perspective when an organization plans to relocate?

Conduct a gap analysis of a new facilities against existing security requirements

Ensure the fire prevention and detection systems are sufficient to protect personnel

Review the architectural plans to determine how many emergency exits are present

Conduct a gap analysis of a new facilities against existing security requirements

Revise the Disaster Recovery and Business Continuity (DR/BC) plan

When assessing an organization's security policy according to standards established by the International Organization for Standardization (ISO) 27001 and 27002, when can management responsibilities be defined?

Only when assets are clearly defined

Only when standards are defined

Only when controls are put in place

Which of the following types of technologies would be the MOST cost-effective method to provide a reactive control for protecting personnel in public areas?

Hire a guard to protect the public area

Install mantraps at the building entrances

Enclose the personnel entry area with polycarbonate plastic

Supply a duress alarm for personnel exposed to the public

Hire a guard to protect the public area

An important principle of defense in depth is that achieving information security requires a balanced focus on which PRIMARY elements?

People, technology, and operations

Development, testing, and deployment

Prevention, detection, and remediation

People, technology, and operations

Certification, accreditation, and monitoring

Intellectual property rights are PRIMARY concerned with which of the following?

Right of the owner to enjoy their creation

Owner's ability to realize financial gain

Owner's ability to maintain copyright

Right of the owner to enjoy their creation

Right of the owner to control delivery method

Which of the following is MOST important when assigning ownership of an asset to a department?

All members should be trained on their responsibilities

The department should report to the business owner

Ownership of the asset should be periodically reviewed

Individual accountability should be ensured

All members should be trained on their responsibilities

Which one of the following affects the classification of data?

Multilevel Security (MLS) architecture

Which of the following BEST describes the responsibilities of a data owner?

Determining the impact the information has on the mission of the organization

Ensuring quality and validation through periodic audits for ongoing data integrity

Maintaining fundamental data availability, including data storage and archiving

Ensuring accessibility to appropriate users, maintaining appropriate levels of data security

Determining the impact the information has on the mission of the organization

When implementing a data classification program, why is it important to avoid too much granularity?

It will be difficult to assign ownership to the data

The process will require too many resources

It will be difficult to apply to both hardware and software

It will be difficult to assign ownership to the data

The process will be perceived as having value

In a data classification scheme, the data is owned by the

Information Technology (IT) managers

Which of the following is an initial consideration when developing an information security management system?

Identify relevant legislative and regulatory compliance requirements

Identify the contractual security obligations that apply to the organizations

Understand the value of the information assets

Identify the level of residual risk that is tolerable to management

Identify relevant legislative and regulatory compliance requirements

Which of the following is an effective control in preventing electronic cloning of Radio Frequency Identification (RFID) based access cards?

Personal Identity Verification (PIV)

Cardholder Unique Identifier (CHUID) authentication

Physical Access Control System (PACS) repeated attempt detection

Asymmetric Card Authentication Key (CAK) challenge-response

Which technique can be used to make an encryption scheme more resistant to a known plaintext attack?

Compressing the data before encryption

Hashing the data before encryption

Hashing the data after encryption

Compressing the data after encryption

Compressing the data before encryption

Which component of the Security Content Automation Protocol (SCAP) specification contains the data required to estimate the severity of vulnerabilities identified automated vulnerability assessments?

Common Vulnerability Scoring System (CVSS)

Common Vulnerabilities and Exposures (CVE)

Common Vulnerability Scoring System (CVSS)

Open Vulnerability and Assessment Language (OVAL)

Who in the organization is accountable for classification of data information assets?

Chief Information Security Officer (CISO)

Chief Information Officer (CIO)

The use of private and public encryption keys is fundamental in the implementation of which of the following?

Advanced Encryption Standard (AES)

What is the purpose of an Internet Protocol (IP) spoofing attack?

To convince a system that it is communicating with a known entity

To send excessive amounts of data to a process, making it unpredictable

To intercept network traffic without authorization

To disguise the destination address from a target's IP filtering devices

To convince a system that it is communicating with a known entity

Which of the following is used by the Point-to-Point Protocol (PPP) to determine packet formats?

Layer 2 Tunneling Protocol (L2TP)

Challenge Handshake Authentication Protocol (CHAP)

An external attacker has compromised an organization's network security perimeter and installed a sniffer onto an inside computer. Which of the following is the MOST effective layer of security the organization could have implemented to mitigate the attacker's ability to gain further information?

Implement logical network segmentation at the switches

Implement packet filtering on the network firewalls

Install Host Based Intrusion Detection Systems (HIDS)

Require strong authentication for administrators

Implement logical network segmentation at the switches

An input validation and exception handling vulnerability has been discovered on a critical web-based system. Which of the following is MOST suited to quickly implement a control?

Add a new rule to the application layer firewall

Install an Intrusion Detection System (IDS)

Patch the application source code

Which of the following is the BEST network defense against unknown types of attacks or stealth attacks in progress?

Network Behavior Analysis (NBA) tools

Intrusion Prevention Systems (IPS)

Intrusion Detection Systems (IDS)

Network Behavior Analysis (NBA) tools

Which of the following factors contributes to the weakness of Wired Equivalent Privacy (WEP) protocol?

WEP uses a small range Initialization Vector (IV)

WEP uses Message Digest 5 (MD5)

WEP does not use any Initialization Vector (IV)

A manufacturing organization wants to establish a Federated Identity Management (FIM) system with its 20 different supplier companies. Which of the following is the BEST solution for the manufacturing organization?

Security Assertion Markup language (SAML)

Trusted third-party certification

Lightweight Directory Access Protocol (LDAP)

Security Assertion Markup language (SAML)

Which of the following BEST describes an access control method utilizing cryptographic keys derived from a smart card private key that is embedded within mobile devices?

Mobile device credentialing service

Users require access rights that allow them to view the average salary of groups of employees.Which control would prevent the users from obtaining an individual employee's salary?

Implement Role Based Access Control (RBAC)

Limit access to predefined queries

Segregate the database into a small number of partitions each with a separate security level

Implement Role Based Access Control (RBAC)

Reduce the number of people who have access to the system for statistical purposes

What is the BEST approach for controlling access to highly sensitive information when employees have the same level of security clearance?

Role-Based Access Control (RBAC)

Which of the following is of GREATEST assistance to auditors when reviewing system configurations?

Operating System (OS) baselines

ISC CISSP Practice Test 1 - Free Online Exam Prep & Questions

All of the following items should be included in a Business Impact Analysis (BIA) questionnaire EXCEPT questions that

determine the risk of a business interruption occurring

determine the technological dependence of the business processes

Identify the operational impacts of a business interruption

Identify the financial impacts of a business interruption

Comment (1)

ISC CISSP Practice Test 1

Question

ISC CISSP Practice Tests

Practice Tests