Which of the following is the MOST challenging issue in apprehending cyber criminals?

The crime is often committed from a different jurisdiction.

They often use sophisticated method to commit a crime.

It is often hard to collect and maintain integrity of digital evidence.

The crime is often committed from a different jurisdiction.

There is often no physical evidence involved.

Which of the following are important criteria when designing procedures and acceptance criteria for acquired software?

Code quality, security, and origin

Architecture, hardware, and firmware

Data quality, provenance, and scaling

Distributed, agile, and bench testing

Which of the following steps should be performed FIRST when purchasing Commercial Off-The-Shelf (COTS) software?

establish policies and procedures on system and services acquisition

undergo a security assessment as part of authorization process

establish a risk management strategy

harden the hosting server, and perform hosting and application vulnerability scans

establish policies and procedures on system and services acquisition

An organization has outsourced its financial transaction processing to a Cloud Service Provider (CSP) who will provide them with Software as a Service (SaaS). If there was a data breach who is responsible for monetary losses?

The Cloud Service Provider (CSP)

The Data Protection Authority (DPA)

The Cloud Service Provider (CSP)

What is the PRIMARY role of a scrum master in agile development?

To project manage the software delivery

To choose the primary development language

To choose the integrated development environment

To match the software requirements to the delivery plan

To project manage the software delivery

An organization plan on purchasing a custom software product developed by a small vendor to support its business model. Which unique consideration should be made part of the contractual agreement potential long-term risks associated with creating this dependency?

Right to request an independent review of the software source code

Due diligence form requesting statements of compliance with security requirements

Access to the technical documentation

Which of the following is the MOST important security goal when performing application interface testing?

Evaluate whether systems or components pass data and control correctly to one another

Confirm that all platforms are supported and function properly

Evaluate whether systems or components pass data and control correctly to one another

Verify compatibility of software, hardware, and network connections

Examine error conditions related to external interfaces to prevent application details leakage

Which of the following is the MOST common method of memory protection?

Virtual Local Area Network (VLAN) tagging

Attack trees are MOST useful for which of the following?

Determining system security scopes

Evaluating Denial of Service (DoS) attacks

Which one of the following is an advantage of an effective release control strategy form a configuration control standpoint?

Ensures that a trace for all deliverables is maintained and auditable

Enforces backward compatibility between releases

Ensures that there is no loss of functionality between releases

Allows for future enhancements to existing features

What is the BEST location in a network to place Virtual Private Network (VPN) devices when an internal review reveals network design flaws in remote access?

In its own separate Virtual Local Area Network (VLAN)

In a dedicated Demilitarized Zone (DMZ)

In its own separate Virtual Local Area Network (VLAN)

At the Internet Service Provider (ISP)

What Is the FIRST step in establishing an information security program?

Establish an information security policy.

Identify factors affecting information security.

Establish baseline security controls.

Identify critical security infrastructure.

Which of the following is the BEST way to reduce the impact of an externally sourced flood attack?

Block the source address at the firewall.

Have the service provider block the soiree address.

Have the soiree service provider block the address.

Block the source address at the firewall.

Block all inbound traffic until the flood ends.

Which of the following is the BEST Identity-as-a-Service (IDaaS) solution for validating users?

Security Assertion Markup Language (SAML)

Lightweight Directory Access Protocol (LDAP)

When conducting a security assessment of access controls, which activity is part of the data analysis phase?

Categorize and identify evidence gathered during the audit.

Present solutions to address audit exceptions.

Conduct statistical sampling of data transactions.

Categorize and identify evidence gathered during the audit.

When a system changes significantly, who is PRIMARILY responsible for assessing the security impact?

Chief Information Security Officer (CISO)

Information System Security Officer (ISSO)

When selecting a disk encryption technology, which of the following MUST also be assured to be encrypted?

Basic Input Output System (BIOS)

Which of the following attacks is dependent upon the compromise of a secondary target in order to reach the primary target?

Address Resolution Protocol (ARP) poisoning

Additional padding may be added to toe Encapsulating Security Protocol (ESP) b trailer to provide which of the following?

Protection against replay attack

Partial traffic flow confidentiality

Protection against replay attack

Company A is evaluating new software to replace an in-house developed application. During the acquisition process. Company A specified the security retirement, as well as the functional requirements. Company B responded to the acquisition request with their flagship product that runs on an Operating System (OS) that Company A has never used nor evaluated. The flagship product meets all security -and functional requirements as defined by Company A.Based upon Company B's response, what step should Company A take?

Conduct a security review of the OS

Move ahead with the acpjisition process, and purchase the flagship software

Conduct a security review of the OS

Enter into contract negotiations ensuring Service Level Agreements (SLA) are established to include security patching

Which of the following is a characteristic of a challenge/response authentication process?

Presenting distorted gravies of text for authentication

Using a password history blacklist

Transmitting a hash based on the user's password

Presenting distorted gravies of text for authentication

Requiring the use of non-consecutive numeric characters

Which of the following is the PRIMARY risk associated with Extensible Markup Language (XML) applications?

The stack data structure cannot be replicated.

The stack data structure is repetitive.

Potential sensitive data leakage.

Activity to baseline, tailor, and scope security controls tikes place dring which National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) step?

Categorize Information system (IS).

A large corporation is locking for a solution to automate access based on where on request is coming from, who the user is, what device they are connecting with, and what time of day they are attempting this access. What type of solution would suit their needs?

Discretionary Access Control (DAC)

Role Based Access Control (RBAC)

Which one of the following is an advantage of an effective release control strategy from a configuration control standpoint?

Enforces backward compatibility between releases

Ensures that there is no loss of functionality between releases

Allows for future enhancements to existing features

Enforces backward compatibility between releases

Ensures that a trace for all deliverables is maintained and auditable

Secure real-time transport protocol (SRTP) provides security for which of the following?

Network Communication for real-time operating systems

Which of the following authorization standards is built to handle Application Programming Interface (API) access for Federated Identity Management (FIM)?

Security Assertion Markup Language (SAML)

Remote Authentication Dial-in User service (RADIUS)

Terminal Access Control Access Control System Plus (TACACS+)

Why do certificate Authorities (CA) add value to the security of electronic commerce transactions?

They provide a secure communication enamel to the transaction parties.

They maintain the certificate revocation list.

They maintain the private keys of transition parties.

They verify the transaction parties' private keys.

They provide a secure communication enamel to the transaction parties.

ISC CISSP Practice Test 16 - Free Online Exam Prep & Questions

Question 1 / 40

What is the MAIN purpose of a change management policy?

To assure management that changes to the Information Technology (IT) infrastructure are necessary

To identify the changes that may be made to the Information Technology (IT) infrastructure

To verify that changes to the Information Technology (IT) infrastructure are approved

To determine the necessary for implementing modifications to the Information Technology (IT) infrastructure

Comment (0)

ISC CISSP Practice Test 16

Question

ISC CISSP Practice Tests

Practice Tests