Of the following, which BEST provides non- repudiation with regards to access to a server room?

Fob and Personal Identification Number (PIN)

The personal laptop of an organization executive is stolen from the office, complete with personnel and project records. Which of the following should be done FIRST to mitigate future occurrences?

Encrypt disks on personal laptops.

Issue cable locks for use on personal laptops.

Create policies addressing critical information on personal laptops.

Monitor personal laptops for critical information.

Which of the following is a standard Access Control List (ACL) element that enables a router to filter Internet traffic?

Media Access Control (MAC) address

Which of the following will accomplish Multi-Factor Authentication (MFA)?

Issuing a smart card with a user-selected Personal Identification Number (PIN)

Requiring users to enter a Personal Identification Number (PIN) and a password

Performing a palm and retinal scan

Issuing a smart card and a One Time Password (OTP) token

Which of the following is the PRIMARY issue when analyzing detailed log information?

Logs do not provide sufficient details of system and individual activities

Logs may be unavailable when required

Timely review of the data is potentially difficult

Most systems and applications do not support logging

Logs do not provide sufficient details of system and individual activities

How does security in a distributed file system using mutual authentication differ from file security in a multi-user host?

Access control can rely on the Operating System (OS), and eavesdropping is

Access control can rely on the Operating System (OS), but eavesdropping is

Access control cannot rely on the Operating System (OS), and eavesdropping

Access control can rely on the Operating System (OS), and eavesdropping is

Access control cannot rely on the Operating System (OS), and eavesdropping

Which of the following explains why classifying data is an important step in performing a Risk assessment?

To help determine the appropriate level of data security controls

To provide a framework for developing good security metrics

To justify the selection of costly security controls

To classify the security controls sensitivity that helps scope the risk assessment

To help determine the appropriate level of data security controls

How is Remote Authentication Dial-In User Service (RADIUS) authentication accomplished?

It uses clear text and shared secret keys.

It uses clear text and firewall rules.

It relies on Virtual Private Networks (VPN).

It uses clear text and shared secret keys.

It relies on asymmetric encryption keys.

A security professional should ensure that clients support which secondary algorithm for digital signatures when a Secure Multipurpose Internet Mail Extension (S/MIME) is used?

Digital Signature Algorithm (DSA)

Triple Data Encryption Standard (3DES)

Advanced Encryption Standard (AES)

Digital Signature Algorithm (DSA)

Who should formulate conclusions from a particular digital fore Ball, Submit a Toper Of Tags, and the results?

Legal counsel for the information security professional's employer

The information security professional's supervisor

Legal counsel for the information security professional's employer

The information security professional who conducted the analysis

A peer reviewer of the information security professional

A manager identified two conflicting sensitive user functions that were assigned to a single user account that had the potential to result in financial and regulatory risk to the company. The manager MOST likely discovered this during which of the following?

Network Access Control (NAC) review

Federated identity management (FIM) evaluation

When assessing the audit capability of an application, which of the following activities is MOST important?

Verify if sufficient storage is allocated for audit records.

Determine if audit records contain sufficient information.

Review security plan for actions to be taken in the event of audit failure.

Verify if sufficient storage is allocated for audit records.

Identify procedures to investigate suspicious activity.

A web-based application known to be susceptible to attacks is now under review by a senior developer. The organization would like to ensure this application Is less susceptible to injection attacks specifically, What strategy will work BEST for the organization's situation?

Whitelist input and encode or escape output before it is processed for rendering.

Do not store sensitive unencrypted data on the back end.

Whitelist input and encode or escape output before it is processed for rendering.

Limit privileged access or hard-coding logon credentials,

Store sensitive data in a buffer that retains data in operating system (OS) cache or memory.

Management has decided that a core application will be used on personal cellular phones. As an implementation requirement, regularly scheduled analysis of the security posture needs to be conducted. Management has also directed that continuous monitoring be implemented. Which of the following is required to accomplish management's directive?

Management application installed on user phones that tracks all application events and cellular traffic

Strict integration of application management, configuration management (CM), and phone management

Management application installed on user phones that tracks all application events and cellular traffic

Enterprise-level security information and event management (SIEM) dashboard that provides full visibility of cellular phone activity

Routine reports generated by the user's cellular phone provider that detail security events

What is the FIRST step prior to executing a test of an organisation's disaster recovery (DR) or business continuity plan (BCP)?

Develop clear evaluation criteria.

Develop recommendations for disaster scenarios.

Identify potential failure points.

Develop clear evaluation criteria.

Which of the following security tools will ensure authorized data is sent to the application when implementing a cloud based application?

Host-based intrusion prevention system (HIPS)

File integrity monitoring (FIM)

Before implementing an internet-facing router, a network administrator ensures that the equipment is baselined/hardened according to approved configurations and settings. This action provides protection against which of the following attacks?

Media Access Control (MAC) flooding

A cloud service provider requires its customer organizations to enable maximum audit logging for its data storage service and to retain the logs for the period of three months. The audit logging generates extremely high amount of logs.What is the MOST appropriate strategy for the log retention?

Keep last week's logs in an online storage and the rest in an offline storage.

Keep last week's logs in an online storage and the rest in a near-line storage.

Keep all logs in an online storage.

Keep all logs in an offline storage.

Keep last week's logs in an online storage and the rest in an offline storage.

ISC CISSP Practice Test 25 - Free Online Exam Prep & Questions

Which of the following actions should be taken by a security professional when a mission critical computer network attack is suspected?

Become a Premium Member for full access

Unlock Premium Member

ISC CISSP Practice Test 25

Question

ISC CISSP Practice Tests

Practice Tests