Which of the following is true of Service Organization Control (SOC) reports?

SOC 2 Type 2 reports include information of interest to the service organization's management

SOC 1 Type 2 reports assess the security, confidentiality, integrity, and availability of an organization's controls

SOC 2 Type 2 reports include information of interest to the service organization's management

SOC 2 Type 2 reports assess internal controls for financial reporting

SOC 3 Type 2 reports assess internal controls for financial reporting

A new Chief Information Officer (CIO) created a group to write a data retention policy based on applicable laws. Which of the following is the PRIMARY motivation for the policy?

To dispose of data in order to limit liability

To back up data that is used on a daily basis

To dispose of data in order to limit liability

To reduce costs by reducing the amount of retained data

To classify data according to what it contains

What determines the level of security of a combination lock?

Complexity of combination required to open the lock

Amount of time it takes to brute force the combination

The number of barrels associated with the internal mechanism

The hardness score of the metal lock material

A user downloads a file from the Internet, then applies the Secure Hash Algorithm 3 (SHA-3c?

It verifies the integrity of the file.

It checks the file for malware.

It ensures the entire file downloaded.

Which of the following is the BEST definition of Cross-Site Request Forgery (CSRF)?

An attack which forces an end user to execute unwanted actions on a web application in which they are currently authenticated

An attack that injects a script into a web page to execute a privileged command

An attack that makes an illegal request across security zones and thereby forges itself into the security database of the system

An attack that forges a false Structure Query Language (SQL) command across systems

Which of the following is the PRIMARY reason a sniffer operating on a network is collecting packets only from its own host?

An Intrusion Detection System (IDS) has dropped the packets.

The network is connected using switches.

The network is connected using hubs.

The network's firewall does not allow sniffing.

Which of the following is mobile device remote fingerprinting?

Identifying a device based on common characteristics shared by all devices of a certain type

Installing an application to retrieve common characteristics of the device

Storing information about a remote device in a cookie file

Identifying a device based on common characteristics shared by all devices of a certain type

Retrieving the serial number of the mobile device

Which of the following open source software issues pose the MOST risk to an application?

The software has multiple Common Vulnerabilities and Exposures (CVE) but the CVEs are classified as low risks.

The software is beyond end of life and the vendor is out of business.

The software is not used or popular in the development community.

The software has multiple Common Vulnerabilities and Exposures (CVE) and only some are remediated.

The software has multiple Common Vulnerabilities and Exposures (CVE) but the CVEs are classified as low risks.

Which of the following is the PRIMARY mechanism used to limit the range of objects available to a given subject within different execution domains?

Use of discrete layering and Application Programming Interfaces (API)

Once the types of information have been identified, who should an information security practitioner work with to ensure that the information is properly categorized?

Business Continuity (BC) Manager

Chief Information Officer (CIO)

What should be the FIRST action for a security administrator who detects an intrusion on the network based on precursors and other indicators?

Apply patches to the Operating Systems (OS).

Isolate and contain the intrusion.

Notify system and application owners.

Apply patches to the Operating Systems (OS).

Document and verify the intrusion.

Which of the following needs to be taken into account when assessing vulnerability?

Risk identification and validation

Which of the following is the key requirement for test results when implementing forensic procedures?

The test result must be authorized.

The test results must be cost-effective.

The test result must be authorized.

The test results must be quantifiable.

The test results must be reproducible.

An Internet software application requires authentication before a user is permitted to utilize the resource. Which testing scenario BEST validates the functionality of the application?

Allowed data bounds and limits testing

A security architect is responsible for the protection of a new home banking system. Which of the following solutions can BEST improve the confidentiality and integrity of this external system?

Intrusion Prevention System (IPS)

Denial of Service (DoS) protection solution

A security professional recommends that a company integrate threat modeling into its Agile development processes. Which of the following BEST describes the benefits of this approach?

Potential threats are addressed earlier in the Software Development Life Cycle (SDLC).

Reduce application development costs.

Potential threats are addressed later in the Software Development Life Cycle (SDLC).

Improve user acceptance of implemented security controls.

Potential threats are addressed earlier in the Software Development Life Cycle (SDLC).

A security consultant has been hired by a company to establish its vulnerability management program. The consultant is now in the deployment phase. Which of the following tasks is part of this process?

Measure effectiveness of the program's stated goals.

Select and procure supporting technologies.

Determine a budget and cost analysis for the program.

Measure effectiveness of the program's stated goals.

Educate and train key stakeholders.

Directive controls are a form of change management policy and procedures. Which of the following subsections are recommended as part of the change management process?

Categorize Information System (IS)

Which of the following BEST describes how access to a system is granted to federated user accounts?

Based on defined criteria by the Identity Provider (IdP)

With the federation assurance level

Based on defined criteria by the Relying Party (RP)

Based on defined criteria by the Identity Provider (IdP)

With the identity assurance level

Which of the following is the primary advantage of segmenting Virtual Machines (VM) using physical networks?

Simplicity of network configuration and network monitoring

Removes the need for decentralized management solutions

Removes the need for dedicated virtual security controls

Simplicity of network configuration and network redundancy

Which of the following would an internal technical security audit BEST validate?

Implementation of changes to a system

Whether managerial controls are in place

Support for security programs by executive management

Appropriate third-party system hardening

Implementation of changes to a system

Which of the following processes has the PRIMARY purpose of identifying outdated software versions, missing patches, and lapsed system updates?

Software Development Life Cycle (SDLC)

A development operations team would like to start building new applications delegating the cybersecurity responsibility as much as possible to the service provider. Which of the following environments BEST fits their need?

Cloud application container within a Virtual Machine (VM)

On premises Virtual Machine (VM)

Self-hosted Virtual Machine (VM)

What access control scheme uses fine-grained rules to specify the conditions under which access to each data item or applications is granted?

Attribute Based Access Control (ABAC)

Discretionary Access Control (DAC)

Role Based Access Control (RBAC)

Attribute Based Access Control (ABAC)

Why is planning the MOST critical phase of a Role Based Access Control (RBAC) implementation?

User populations to be assigned to each role is determined.

The criteria for measuring risk is defined.

User populations to be assigned to each role is determined.

Role mining to define common access patterns is performed.

The foundational criteria are defined.

Vulnerability scanners may allow for the administrator to assign which of the following in order to assist in prioritizing remediation activities?

Definitions for each exposure type

Physical assets defined in an organization's Business Impact Analysis (BIA) could include which of the following?

Supplies kept off-site at a remote facility

Personal belongings of organizational staff members

Supplies kept off-site at a remote facility

Disaster Recovery (DR) line-item revenues

ISC CISSP Practice Test 21 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

ISC CISSP Practice Test 21

Question

ISC CISSP Practice Tests

Practice Tests