The application owner of a system that handles confidential data leaves an organization. It is anticipated that a replacement will be hired in approximately six months. During that time, which of the following should the organization do?

Assign a temporary application owner to the system.

Gram temporary access to the former application owner's account

Assign a temporary application owner to the system.

Restrict access to the system until a replacement application owner rs hired.

Prevent changes to the confidential data until a replacement application owner is hired.

Which of the following is used to ensure that data mining activities Will NOT reveal sensitive data?

Implement the principle of least privilege on data elements so a reduced number of users can access the database.

Implement two-factor authentication on the underlying infrastructure.

Encrypt data at the field level and tightly control encryption keys.

Preprocess the databases to see if inn ...... can be disclosed from the learned patterns.

Implement the principle of least privilege on data elements so a reduced number of users can access the database.

Why are packet filtering routers used in low-risk environments?

They are fast and flexible, and protect against Internet Protocol (IP) spoofing.

They are high-resolution source discrimination and identification tools.

They are fast and flexible, and protect against Internet Protocol (IP) spoofing.

They are fast, flexible, and transparent.

They enforce strong user authentication and audit tog generation.

Which of the following protocols will allow the encrypted transfer of content on the Internet?

Hypertext Transfer Protocol (HTTP)

What requirement MUST be met during internal security audits to ensure that all information provided is expressed as an objective assessment without risk of retaliation?

The auditor must be independent and report directly to the management.

The auditor must utilize automated tools to back their findings.

The auditor must work closely with both the information Technology (IT) and security sections of an organization.

The auditor must perform manual reviews of systems and processes.

In order to support the least privilege security principle when a resource is transferring within the organization from a production support system administration role to a developer role, what changes should be made to the resource's access to the production operating system (OS) directory structure?

From Administrator privileges to No Access privileges

From Read Only privileges to No Access Privileges

From Author privileges to Administrator privileges

From Administrator privileges to No Access privileges

From No Access Privileges to Author privileges

Which of the following is a security weakness in the evaluation of common criteria (CC) products?

The manufacturer can state what configuration of the product is to be evaluated.

The product can be evaluated by labs m other countries.

The Target of Evaluation's (TOE) testing environment is identical to the operating environment

The evaluations are expensive and time-consuming to perform.

Which of the following BEST describes the standard used to exchange authorization information between different identity management systems?

Security Assertion Markup Language (SAML)

Service Oriented Architecture (SOA)

Extensible Markup Language (XML)

Wireless Authentication Protocol (WAP)

Obtain information security management approval.

Maintain the integrity of the application.

Obtain feedback before implementation.

Which of the following is the FIRST step during digital identity provisioning?

Creating the entity record with the correct attributes

Authorizing the entity for resource access

Issuing an initial random password

Creating the entity record with the correct attributes

Physical Access Control Systems (PACS) allow authorized security personnel to manage and monitor access control for subjects through which function?

Personal Identity Verification (PIV)

Privileged Identity Management (PIM)

In a large company, a system administrator needs to assign users access to files using Role Based Access Control (RBAC). Which option Is an example of RBAC?

Mowing users access to files based on their group membership

Allowing users access to files based on username

Allowing users access to files based on the users location at time of access

Allowing users access to files based on the file type

What is the MAIN objective of risk analysis in Disaster Recovery (DR) planning?

Identify potential threats to business availability.

Establish Maximum Tolerable Downtime (MTD) Information Systems (IS).

Define the variable cost for extended downtime scenarios.

Identify potential threats to business availability.

Establish personnel requirements for various downtime scenarios.

The adoption of an enterprise-wide Business Continuity (BC) program requires which of the following?

Well-documented information asset classification

Good communication throughout the organization

A completed Business Impact Analysis (BIA)

Formation of Disaster Recovery (DR) project team

Well-documented information asset classification

Which of the following is the BEST way to protect against Structured Query language (SQL) injection?

Restrict HyperText Markup Language (HTML) source code

When defining a set of security controls to mitigate a risk, which of the following actions MUST occur?

Each control's effectiveness must be evaluated individually.

Each control must completely mitigate the risk.

The control set must adequately mitigate the risk.

The control set must evenly divided the risk.

A company-wide penetration test result shows customers could access and read files through a web browser. Which of the following can be used to mitigate this vulnerability?

Enforce the control of file directory listings.

Enforce the chmod of files to 755.

Enforce the control of file directory listings.

Implement access control on the web server.

Implement Secure Sockets Layer (SSL) certificates throughout the web server.

Which of the following provides the MOST secure method for Network Access Control (NAC)?

Media Access Control (MAC) filtering

Network Address Translation (NAT)

Which of the following is considered the PRIMARY security issue associated with encrypted e-mail messages?

Scanning for viruses and other malware

Storing attachments in centralized repositories

Scanning for viruses and other malware

Greater costs associated for backups and restores

Which of the following is the MOST secure protocol for zremote command access to the firewall?

Trivial File Transfer Protocol (TFTP)

Hypertext Transfer Protocol Secure (HTTPS)

Simple Network Management Protocol (SNMP) v1

How should the retention period for an organization's social media content be defined?

By the records retention policy of the organization

By the retention policies of each social media service

By the records retention policy of the organization

By the Chief Information Officer (CIO)

By the amount of available storage space

In Identity Management (IdM), when is the verification stage performed?

Before creation of the identity

After revocation of the identity

During authorization of the identity

What is the PRIMARY purpose of auditing, as it relates to the security review cycle?

To ensure the organization's controls and pokies are working as intended

To ensure the organization can still be publicly traded

To ensure the organization's executive team won't be sued

To ensure the organization meets contractual requirements

Which of the following access control models is MOST restrictive?

Discretionary Access Control (DAC)

Role Based Access Control (RBAC)

Which of the following is a canon of the (ISC)2 Code of Ethics?

Provide diligent and competent service to principals.

Integrity first, association before serf, and excellence in all we do

Perform all professional activities and duties in accordance with all applicable laws and the highest ethical standards.

Provide diligent and competent service to principals.

Cooperate with others in the interchange of knowledge and ideas for mutual security.

A security professional has been requested by the Board of Directors and Chief Information Security Officer (CISO) to perform an internal and external penetration test. What is the BEST course of action?

With notice to the organization, perform an external penetration test first, then an internal test.

Review data localization requirements and regulations.

Review corporate security policies and procedures,

With notice to the Configuring a Wireless Access Point (WAP) with the same Service Set Identifier external test.

With notice to the organization, perform an external penetration test first, then an internal test.

The Rivest-Shamir-Adleman (RSA) algorithm is BEST suited for which of the following operations?

Secure key exchange for symmetric cryptography

Bulk data encryption and decryption

One-way secure hashing for user and message authentication

Secure key exchange for symmetric cryptography

Creating digital checksums for message integrity

Configuring a Wireless Access Point (WAP) with the same Service Set Identifier (SSID) as another WAP in order to have users unknowingly connect is referred to as which of the following?

Internet Protocol (IP) spoofing

ISC CISSP Practice Test 24 - Free Online Exam Prep & Questions

Which of the following BEST describes the objectives of the Business Impact Analysis (BIA)?

Become a Premium Member for full access

Unlock Premium Member

ISC CISSP Practice Test 24

Question

ISC CISSP Practice Tests

Practice Tests