Which of the following is MOST important when deploying digital certificates?

Establish a certificate life cycle management framework

Validate compliance with X.509 digital certificate standards

Establish a certificate life cycle management framework

Use a third-party Certificate Authority (CA)

Use no less than 256-bit strength encryption when creating a certificate

A user sends an e-mail request asking for read-only access to files that are not considered sensitive. A Discretionary Access Control (DAC) methodology is in place. Which is the MOST suitable approach that the administrator should take?

Administrator should request data owner approval to the user access

Administrator should request manager approval for the user access

Administrator should directly grant the access to the non-sensitive files

Administrator should assess the user access need and either grant or deny the access

How should an organization determine the priority of its remediation efforts after a vulnerability assessment has been conducted?

Use a criticality-based approach.

Which of the following is the MOST important consideration when developing a Disaster Recovery Plan (DRP)?

A recovery strategy for all business processes

The dynamic reconfiguration of systems

A recovery strategy for all business processes

Although code using a specific program language may not be susceptible to a buffer overflow attack,

the graphical images used by the application could be susceptible.

most calls to plug-in programs are susceptible.

most supporting application code is susceptible.

the graphical images used by the application could be susceptible.

the supporting virtual machine could be susceptible.

What is the BEST way to encrypt web application communications?

Secure Hash Algorithm 1 (SHA-1)

Cipher Block Chaining Message Authentication Code (CBC-MAC)

Which of the following are effective countermeasures against passive network-layer attacks?

Encryption and security enabled applications

Federated security and authenticated access controls

Trusted software development and run time integrity controls

Encryption and security enabled applications

Enclave boundary protection and computing environment defense

What is the MOST important element when considering the effectiveness of a training program for Business Continuity (BC) and Disaster Recovery (DR)?

Consideration of organizational need

A database administrator is asked by a high-ranking member of management to perform specific changes to the accounting system database. The administrator is specifically instructed to not track or evidence the change in a ticket. Which of the following is the BEST course of action?

Inform the audit committee or internal audit directly using the corporate whistleblower process.

Ignore the request and do not perform the change.

Perform the change as requested, and rely on the next audit to detect and report the situation.

Perform the change, but create a change ticket regardless to ensure there is complete traceability.

Inform the audit committee or internal audit directly using the corporate whistleblower process.

Which of the following is the MOST important goal of information asset valuation?

Determining the appropriate level of protection

Developing a consistent and uniform method of controlling access on information assets

Developing appropriate access control policies and guidelines

Assigning a financial value to an organization's information assets

Determining the appropriate level of protection

Which of the following is a strategy of grouping requirements in developing a Security Test and Evaluation (ST&E)?

Management, operational, and technical

Tactical, strategic, and financial

Management, operational, and technical

Documentation, observation, and manual

Standards, policies, and procedures

Which one of the following activities would present a significant security risk to organizations when employing a Virtual Private Network (VPN) solution?

Simultaneous connection to other networks

Users with Internet Protocol (IP) addressing conflicts

Remote users with administrative rights

Which of the following BEST describes a chosen plaintext attack?

The cryptanalyst can generate ciphertext from arbitrary text.

The cryptanalyst examines the communication being sent back and forth.

The cryptanalyst can choose the key and algorithm to mount the attack.

The cryptanalyst is presented with the ciphertext from which the original message is determined.

Which of the following is the PRIMARY reason to perform regular vulnerability scanning of an organization network?

Validate vulnerability remediation activities.

Provide vulnerability reports to management.

Validate vulnerability remediation activities.

Prevent attackers from discovering vulnerabilities.

Remediate known vulnerabilities.

Which of the following is needed to securely distribute symmetric cryptographic keys?

An organizationally approved communication protection policy and key management plan

Officially approved Public-Key Infrastructure (PKI) Class 3 or Class 4 certificates

Officially approved and compliant key management technology and processes

An organizationally approved communication protection policy and key management plan

Hardware tokens that protect the user's private key.

Reciprocal backup site agreements are considered to be

difficult to test for complex systems.

a better alternative than the use of warm sites.

difficult to test for complex systems.

easy to implement for similar types of organizations.

easy to test and implement for complex systems.

In order to assure authenticity, which of the following are required?

Confidentiality and authentication

Authentication and non-repudiation

An organization regularly conducts its own penetration tests. Which of the following scenarios MUST be covered for the test to be effective?

System administrator access compromised

Third-party vendor with access to the system

System administrator access compromised

Internal attacker with access to the system

Internal user accidentally accessing data

A company was ranked as high in the following National Institute of Standards and Technology (NIST) functions: Protect, Detect, Respond and Recover. However, a low maturity grade was attributed to the Identify function. In which of the following the controls categories does this company need to improve when analyzing its processes individually?

Asset Management, Business Environment, Governance and Risk Assessment

Access Control, Awareness and Training, Data Security and Maintenance

Anomalies and Events, Security Continuous Monitoring and Detection Processes

Recovery Planning, Improvements and Communications

What is the difference between media marking and media labeling?

Media marking refers to security attributes required by public policy/law, while media labeling refers to security attributes required by internal organizational policy.

Media marking refers to the use of human-readable security attributes, while media labeling refers to the use of security attributes in internal data structures.

Media labeling refers to the use of human-readable security attributes, while media marking refers to the use of security attributes in internal data structures.

Media labeling refers to security attributes required by public policy/law, while media marking refers to security required by internal organizational policy.

Media marking refers to security attributes required by public policy/law, while media labeling refers to security attributes required by internal organizational policy.

What balance MUST be considered when web application developers determine how informative application error messages should be constructed?

Availability versus auditability

Confidentiality versus integrity

Performance versus user satisfaction

What operations role is responsible for protecting the enterprise from corrupt or contaminated media?

Information security practitioner

Which of the following is a characteristic of the initialization vector when using Data Encryption Standard (DES)?

It can be transmitted in the clear as a random number.

It must be known to both sender and receiver.

It can be transmitted in the clear as a random number.

It must be retained until the last block is transmitted.

It can be used to encrypt and decrypt information.

In general, servers that are facing the Internet should be placed in a demilitarized zone (DMZ). What is MAIN purpose of the DMZ?

Reduced risk to internal systems.

Prepare the server for potential attacks.

Mitigate the risk associated with the exposed server.

Bypass the need for a firewall.

Network-based logging has which advantage over host-based logging when reviewing malicious activity about a victim machine?

Addresses and protocols of network-based logs are analyzed.

Host-based system logging has files stored in multiple locations.

Properly handled network-based logs may be more reliable and valid.

Network-based systems cannot capture users logging into the console.

Which of the following is the PRIMARY reason for employing physical security personnel at entry points in facilities where card access is in operation?

To provide a safe environment for employees.

To verify that only employees have access to the facility.

To identify present hazards requiring remediation.

To monitor staff movement throughout the facility.

To provide a safe environment for employees.

ISC CISSP Practice Test 12 - Free Online Exam Prep & Questions

Which of the following is BEST suited for exchanging authentication and authorization messages in a multi-party decentralized environment?

Become a Premium Member for full access

Unlock Premium Member

ISC CISSP Practice Test 12

Question

ISC CISSP Practice Tests

Practice Tests