A financial company has decided to move its main business application to the Cloud. The legal department objects, arguing that the move of the platform should comply with several regulatory obligations such as the General Data Protection (GDPR) and ensure data confidentiality. The Chief Information Security Officer (CISO) says that the cloud provider has met all regulations requirements and even provides its own encryption solution with internally-managed encryption keys to address data confidentiality. Did the CISO address all the legal requirements in this situation?

Yes, because the cloud provider meets all regulations requirements.

No, because the encryption solution is internal to the cloud provider.

Yes, because the cloud provider meets all regulations requirements.

Yes, because the cloud provider is GDPR compliant.

No, because the cloud provider is not certified to host government data.

Which of the following is PRIMARILY adopted for ensuring the integrity of information is preserved?

Role Based Access Control (RBAC)

Why might a network administrator choose distributed virtual switches instead of stand-alone switches for network segmentation?

To maximize data plane efficiency

To standardize on a single vendor

To ensure isolation of management traffic

To maximize data plane efficiency

To reduce the risk of configuration errors

Organization A is adding a large collection of confidential data records that it received when it acquired Organization B to its data store. Many of the users and staff from Organization B are no longer available. Which of the following MUSTOrganization A 0do to property classify and secure the acquired data?

Assign data owners from Organization A to the acquired data.

Create placeholder accounts that represent former users from Organization B.

Archive audit records that refer to users from Organization A.

Change the data classification for data acquired from Organization B.

An organization has a short-term agreement with a public Cloud Service Provider (CSP). Which of the following BEST protects sensitive data once the agreement expires and the assets are reused?

Use a contractual agreement to ensure the CSP wipes the data from the storage environment.

Recommended that the business data owners use continuous monitoring and analysis of applications to prevent data loss.

Recommend that the business data owners use internal encryption keys for data-at-rest and datain- transit to the storage environment.

Use a contractual agreement to ensure the CSP wipes the data from the storage environment.

Use a National Institute of Standards and Technology (NIST) recommendation for wiping data on the storage environment.

Which of the following techniques is effective to detect taps in fiber optic cables?

Measuring signal through external oscillator solution devices

Taking baseline signal level of the cable

Measuring signal through external oscillator solution devices

Outlining electromagnetic field strength

Performing network vulnerability scanning

When would an organization review a Business Continuity Management (BCM) system?

When major changes occur on systems

Before and after Disaster Recovery (DR) tests

Which of the following is a characteristic of the independent testing of a program?

Independent testing increases the likelihood that a test will expose the effect of a hidden feature.

Independent testing decreases the likelihood that a test will expose the effect of a hidden feature.

Independent testing teams help decrease the cost of creating test data and system design specification.

Independent testing teams help identify functional requirements and Service Level Agreements (SLA)

What is the BEST approach for maintaining ethics when a security professional is unfamiliar with the culture of a country and is asked to perform a questionable task?

Become familiar with the means in which the code of ethics is applied and considered.

Exercise due diligence when deciding to circumvent host government requests.

Become familiar with the means in which the code of ethics is applied and considered.

Complete the assignment based on the customer's wishes.

Execute according to the professional's comfort level with the code of ethics.

Which of the following activities is MOST likely to be performed during a vulnerability assessment?

Review professorial credentials of the vulnerability assessment team or vendor.

Establish caller authentication procedures to verify the identities of users.

Analyze the environment by conducting interview sessions with relevant parties.

Document policy exceptions required to access systems in non-compliant areas.

Review professorial credentials of the vulnerability assessment team or vendor.

Which of the following is the BEST defense against password guessing?

Require a combination of letters, numbers, and special characters in the password.

Limit external connections to the network.

Disable the account after a limited number of unsuccessful attempts.

Force the password to be changed after an invalid password has been entered.

Require a combination of letters, numbers, and special characters in the password.

Why would a security architect specify that a default route pointing to a sinkhole be injected into internal networks?

To detect the traffic destined to non-existent network destinations

To have firewalls route all network traffic

To detect the traffic destined to non-existent network destinations

To exercise authority over the network department

To re-inject the route into external networks

Which one of the following documentation should be included in a Disaster Recovery (DR) package?

Hardware configuration instructions, hardware configuration software, an operating system image, a data restoration option, media retrieval instructions, ...

Source code, compiled code, firmware updates, operational log book and manuals.

Data encrypted in original format, auditable transaction data, and recovery instructions for future extraction on demand.

Hardware configuration instructions, hardware configuration software, an operating system image, a data restoration option, media retrieval instructions, ...

System configuration including hardware, software, hardware, interfaces, software Application Programming Interface (API) configuration, data structure, ....

How long should the records on a project be retained?

Until they are no longer useful or required by policy

For the duration of the project, or at the discretion of the record owner

Until they are no longer useful or required by policy

Until five years after the project ends, then move to archives

For the duration of the organization fiscal year

Which of the following provides the BEST method to verify that security baseline configurations are maintained?

Perform regular system security testing.

Design security early in the development cycle.

Analyze logs to determine user activities.

Perform quarterly risk assessments.

Which of the following is the MOST critical success factor in the security patch management process?

Tracking and reporting on inventory

Which of the following is the BEST technique to facilitate secure software development?

Adhere to secure coding practices for the software application under development.

Conduct penetrating testing for the software application under development.

Develop a threat modeling review for the software application under development.

Perform a code review process for the software application under development.

What is the MAIN reason to ensure the appropriate retention periods are enforced for data stored on electronic media?

To reduce the risk of loss, unauthorized access, use, modification, and disclosure

To reduce the carbon footprint by eliminating paper

To create an inventory of data assets stored on disk for backup and recovery

To declassify information that has been improperly classified

To reduce the risk of loss, unauthorized access, use, modification, and disclosure

What is the BEST way to correlate large volumes of disparate data sources in a Security Operations Center (SOC) environment?

Implement a Security Information and Event Management (SIEM) system.

Implement Intrusion Detection System (IDS).

Implement a Security Information and Event Management (SIEM) system.

Hire a team of analysts to consolidate data and generate reports.

Outsource the management of the SOC.

Which of the following steps should be conducted during the FIRST phase of software assurance in a generic acquisition process?

Developing software requirements to be included in work statement

Establishing and consenting to the contract work schedule

Issuing a Request for proposal (RFP) with a work statement

Developing software requirements to be included in work statement

Reviewing and accepting software deliverables

Assume that a computer was powered off when an information security professional arrived at a crime scene. Which of the following actions should be performed after the crime scene is isolated?

Leave the computer off and prepare the computer for transportation to the laboratory

Turn the computer on and collect volatile data.

Turn the computer on and collect network information.

Leave the computer off and prepare the computer for transportation to the laboratory

Remove the hard drive, prepare it for transportation, and leave the hardware ta the scene.

An organization is considering outsourcing applications and data to a Cloud Service Provider (CSP). Which of the following is the MOST important concern regarding privacy?

The CSP may not be subject to the organization's country legation.

The CSP determines data criticality.

The CSP provides end-to-end encryption services.

The CSP's privacy policy may be developer by the organization.

The CSP may not be subject to the organization's country legation.

The MAIN task of promoting security for Personal Computers (PC) is

making sure that users are using only valid, authorized software, so that the chance of virus infection

understanding the technical controls and ensuring they are correctly installed.

understanding the required systems and patching processes for different Operating Systems (OS).

making sure that users are using only valid, authorized software, so that the chance of virus infection

making users understand the risks to the machines and data, so they will take appropriate steps to project them.

The Secure Shell (SSH) version 2 protocol supports.

authentication, compression, confidentiality, and integrity.

availability, accountability, compression, and integrity,

authentication, availability, confidentiality, and integrity.

accountability, compression, confidentiality, and integrity.

authentication, compression, confidentiality, and integrity.

What protocol is often used between gateway hosts on the Internet' To control the scope of a Business Continuity Management (BCM) system, a security practitioner should identify which of the following?

Business needs of the security organization

Size, nature, and complexity of the organization

Business needs of the security organization

Adaptation model for future recovery planning

Which of the following is a peor entity authentication method for Point-to-Point Protocol (PPP)?

Challenge Handshake Authentication Protocol (CHAP)

Message Authentication Code (MAC)

Transport Layer Security (TLS) handshake protocol

Challenge-response authentication mechanism

What form of attack could this represent?

A masquerading attack that sends packets intended for 10.102.10.6 to 10.102.10.2

A Denial of Service (DoS) attack against the gateway router because the router can no longer accept packets from

A transport layer attack that prevents the resolution of 10.102.10.6 address

A Denial of Service (DoS) attack against 10.102.10.2 because it cannot respond correctly to ARP requests

A masquerading attack that sends packets intended for 10.102.10.6 to 10.102.10.2

ISC CISSP Practice Test 22 - Free Online Exam Prep & Questions

Which of the following encryption types is used in Hash Message Authentication Code (HMAC) for key distribution?

Become a Premium Member for full access

Unlock Premium Member

ISC CISSP Practice Test 22

Question

ISC CISSP Practice Tests

Practice Tests