Which of the following needs to be included in order for High Availability (HA) to continue operations during planned system outages?

Clustering, load balancing, and fault-tolerant options

Redundant hardware, disk spanning, and patching

Load balancing, power reserves, and disk spanning

Backups, clustering, and power reserves

Clustering, load balancing, and fault-tolerant options

Point-to-Point Protocol (PPP) was designed to specifically address what issue?

Speed and reliability issues between dial-up users and Internet Service Providers (ISP).

A common design flaw in telephone modems

Speed and reliability issues between dial-up users and Internet Service Providers (ISP).

Compatibility issues with personal computers and web browsers

The security of dial-up connections to remote networks

Which of the following is an advantage of' Secure Shell (SSH)?

It uses challenge-response to authenticate each party.

It operates at the network layer.

It encrypts transmitted User ID and passwords.

It uses challenge-response to authenticate each party.

It uses the International Data Encryption Algorithm (IDEA) for data privacy.

Which of the following is a PRIMARY challenge when running a penetration test?

Determining the depth of coverage

Remediating found vulnerabilities

Determining the depth of coverage

Which one of the following would cause an immediate review and possible change to the security policies of an organization?

Change to organization processes

An audit of an application reveals that the current configuration does not match the configuration of the originally implemented application. Which of the following is the FIRST action to be taken?

Verify the approval of the configuration change.

Recommend an update to the change control process.

Verify the approval of the configuration change.

Roll back the application to the original configuration.

Document the changes to the configuration.

What is the BEST method if an investigator wishes to analyze a hard drive which may be used as evidence?

Remove the hard drive from the system and make a copy of the hard drive's contents using imaging hardware.

Leave the hard drive in place and use only verified and authenticated Operating Systems (OS) utilities ...

Log into the system and immediately make a copy of all relevant files to a Write Once, Read Many ...

Remove the hard drive from the system and make a copy of the hard drive's contents using imaging hardware.

Use a separate bootable device to make a copy of the hard drive before booting the system and analyzing the hard drive.

Which of the following provides the GREATEST level of data security for a Virtual Private Network (VPN) connection?

Internet Protocol Security (IPSec)

Internet Protocol Payload Compression (IPComp)

Internet Protocol Security (IPSec)

Extensible Authentication Protocol (EAP)

Remote Authentication Dial-In User Service (RADIUS)

The signer verifies that the software being loaded is the software originated by the signer.

The vendor certifies the software being loaded is free of malicious code and that it was originated by the signer.

The signer verifies that the software being loaded is free of malicious code.

Both vendor and the signer certify the software being loaded is free of malicious code and it was originated by the signer.

What is the PRIMARY objective for conducting an internal security audit?

Verify that applicable security controls are implemented and effective.

Verify that all systems and Standard Operating Procedures (SOP) are properly documented.

Verify that all personnel supporting a system are knowledgeable of their responsibilities.

Verify that security controls are established following best practices.

Verify that applicable security controls are implemented and effective.

What is the PRIMARY purpose for an organization to conduct a security audit?

To ensure the organization is adhering to a well-defined standard

To ensure the organization is applying security controls to mitigate identified risks

To ensure the organization is configuring information systems efficiently

To ensure the organization is documenting findings

Which of the following is a MAJOR concern when there is a need to preserve or retain information for future retrieval?

The organization may lose track of the information and not dispose of it securely.

Laws and regulations may change in the interim, making it unnecessary to retain the information.

The expense of retaining the information could become untenable for the organization.

The organization may lose track of the information and not dispose of it securely.

The technology needed to retrieve the information may not be available in the future.

Which of the following types of data would be MOST difficult to detect by a forensic examiner?

Data stored with a different file type extension

Following a penetration test, what should an organization do FIRST?

Evaluate the problems identified in the test result.

Review all security policies and procedures.

Ensure staff is trained in security.

Determine if you need to conduct a full security assessment.

Evaluate the problems identified in the test result.

An Intrusion Detection System (IDS) is based on the general hypothesis that a security violation is associated with a pattern of system usage which can be

differentiated from a normal usage pattern.

used to detect known violations.

differentiated to detect all security violations.

When developing the entitlement review process, which of the following roles is responsible for determining who has a need for the information?

Information Technology (IT) Director

What should an auditor do when conducting a periodic audit on media retention?

Check electronic storage media to ensure records are not retained past their destruction date.

Ensure authorized personnel are in possession of paper copies containing Personally Identifiable Information....

Check that hard disks containing backup data that are still within a retention cycle are being destroyed....

Ensure that data shared with outside organizations is no longer on a retention schedule.

Which of the following factors is á PRIMARY reason to drive changes in an Information Security Continuous Monitoring (ISCM) strategy?

Changes to core missions or business processes

Testing and Evaluation (TE) personnel changes

Changes to core missions or business processes

Increased Cross-Site Request Forgery (CSRF) attacks

Changes in Service Organization Control (SOC) 2 reporting requirements

Data remanence is the biggest threat in which of the following scenarios?

A flash drive has been overwritten and released to a third party for destruction.

A physical disk drive has been overwritten and reused within a datacenter.

A physical disk drive has been degaussed, verified, and released to a third party for dest....

A flash drive has been overwritten, verified, and reused within a datacenter.

A flash drive has been overwritten and released to a third party for destruction.

Which of the following is a Key Performance Indicator (KPI) for a security training and awareness program?

The number of attendees at security training events

The number of security audits performed

The number of attendees at security training events

The number of security training materials created

The number of security controls implemented

When are security requirements the LEAST expensive to implement?

When built into application design

When identified by external consultants

During the application rollout phase

During each phase of the project cycle

When built into application design

What type of attack sends Internet Control Message Protocol (ICMP) echo requests to the target machine with a larger payload than the target can handle?

Domain Name Server (DNS) poisoning

What is the HIGHEST priority in agile development?

Early and continuous delivery of software

Selecting appropriate coding language

Managing costs of product delivery

Early and continuous delivery of software

Maximizing the amount of code delivered

Which of the following is included in the Global System for Mobile Communications (GSM) security framework?

Public-Key Infrastructure (PKI)

Which of the following is an important requirement when designing a secure remote access system?

Ensure that logging and audit controls are included.

Configure a Demilitarized Zone (DMZ) to ensure that user and service traffic is separated.

Provide privileged access rights to computer files and systems.

Ensure that logging and audit controls are included.

Reduce administrative overhead through password self service.

Which of the following is the BEST way to mitigate circumvention of access controls?

Multi-layer access controls with diversification of technologies

Multi-layer access controls working in isolation

Multi-vendor approach to technology implementation

Multi-layer firewall architecture with Internet Protocol (IP) filtering enabled

Multi-layer access controls with diversification of technologies

Which of the following is the MOST effective preventative method to identify security flaws in software?

Perform a structured code review.

Monitor performance in production environments.

Perform a structured code review.

Perform application penetration testing.

Use automated security vulnerability testing tods.

Which of the following BEST describes botnets?

Groups of computers that are used to launch destructive attacks

Computer systems on the Internet that are set up to trap people who attempt to penetrate other computer system

Set of related programs that protects the resources of a private network from other networks

Small network inserted in a neutral zone between an organization's private network and the outside public network

Groups of computers that are used to launch destructive attacks

Install an on-premise Authentication Gateway Service (AGS) In front of the service provider.

Require the cloud 1AM provider to use declarative security instead of programmatic authentication checks.

Integrate a Web-Application Firewall (WAF) In reverie-proxy mode in front of the service provider.

Apply Transport layer Security (TLS) to the cloud-based authentication checks.

Install an on-premise Authentication Gateway Service (AGS) In front of the service provider.

ISC CISSP Practice Test 23 - Free Online Exam Prep & Questions

Which of the following value comparisons MOST accurately reflects the agile development approach?

Become a Premium Member for full access

Unlock Premium Member

ISC CISSP Practice Test 23

Question

ISC CISSP Practice Tests

Practice Tests