Which of the following BEST describes the purpose of software forensics?

To determine the author and behavior of the code

To perform cyclic redundancy check (CRC) verification and detect changed applications

To review program code to determine the existence of backdoors

To analyze possible malicious intent of malware

To determine the author and behavior of the code

An application is used for funds transfer between an organization and a third-party. During a security audit, an issue with the business continuity/disaster recovery policy and procedures for this application. Which of the following reports should the audit file with the organization?

Service Organization Control (SOC) 2

Service Organization Control (SOC) 1

Statement on Auditing Standards (SAS) 70

Service Organization Control (SOC) 2

Statement on Auditing Standards (SAS) 70-1

An organization purchased a commercial off-the-shelf (COTS) software several years ago. The information technology (IT) Director has decided to migrate the application into the cloud, but is concerned about the application security of the software in the organization's dedicated environment with a cloud service provider. What is the BEST way to prevent and correct the software's security weal

Implement a dedicated COTS sandbox environment

Follow the software end-of-life schedule

Transfer the risk to the cloud service provider

Examine the software updating and patching process

Which reporting type requires a service organization to describe its system and define its control objectives and controls that are relevant to users internal control over financial reporting?

Service Organization Control 1 (SOC1)

Statement on Auditing Standards (SAS)70

Service Organization Control 1 (SOC1)

Service Organization Control 2 (SOC2)

Service Organization Control 3 (SOC3)

The Chief Information Security Officer (CISO) is concerned about business application availability. The organization was recently subject to a ransomware attack that resulted in the unavailability of applications and services for 10 working days that required paper-based running of all main business processes. There are now aggressive plans to enhance the Recovery Time Objective (RTO) and cater for more frequent data captures. Which of the following solutions should be implemented to fully comply to the new business requirements?

Host-based intrusion prevention system (HIPS)

Which of the following is the GREATEST risk of relying only on Capability Maturity Models (CMM) for software to guide process improvement and assess capabilities of acquired software?

CMMs do not explicitly address safety and security

Organizations can only reach a maturity level 3 when using CMMs

CMMs do not explicitly address safety and security

CMMs can only be used for software developed in-house

CMMs are vendor specific and may be biased

Which of the following should exist in order to perform a security audit?

Industry framework to audit against

Which of the following encryption technologies has the ability to function as a stream cipher?

Cipher Block Chaining (CBC) with error propagation

An attack utilizing social engineering and a malicious Uniform Resource Locator (URL) link to take advantage of a victim's existing browser session with a web application is an example of which of the following types of attack?

Cross-site request forgery (CSRF)

A security professional has reviewed a recent site assessment and has noted that a server room on the second floor of a building has Heating, Ventilation, and Air Conditioning (HVAC) intakes on the ground level that have ultraviolet light filters installed, Aero-K Fire suppression in the server room, and pre-action fire suppression on floors above the server room. Which of the following changes can the security professional recommend to reduce risk associated with these conditions?

Apply additional physical security around the HVAC intakes and update upper floor fire suppression to FM-200.

Remove the ultraviolet light filters on the HVAC intake and replace the fire suppression system on the upper floors with a dry system

Add additional ultraviolet light filters to the HVAC intake supply and return ducts and change server room fire suppression to FM-200

Apply additional physical security around the HVAC intakes and update upper floor fire suppression to FM-200.

Elevate the HVAC intake by constructing a plenum or external shaft over it and convert the server room fire suppression to a pre-action system

An organization is setting a security assessment scope with the goal of developing a Security Management Program (SMP). The next step is to select an approach for conducting the risk assessment. Which of the following approaches isMOST effective for the SMP?

Data driven risk assessment with a focus on data

Security controls driven assessment that focuses on controls management

Business processes based risk assessment with a focus on business goals

Asset driven risk assessment with a focus on the assets

Which combination of cryptographic algorithms are compliant with Federal Information Processing Standard (FIPS) Publication 140-2 for non-legacy systems?

Diffie-hellman (DH) key exchange: DH (<= 1024 bits)Symmetric Key: BlowfishDigital Signature: Rivest-Shamir-Adleman (RSA) (>=2048 bits)

Diffie-hellman (DH) key exchange: DH (>=2048 bits)Symmetric Key: Advanced Encryption Standard (AES) > 128 bitsDigital Signature: Rivest-Shamir-Adleman (RSA) (1024 bits)

Diffie-hellman (DH) key exchange: DH (>=2048 bits)Symmetric Key: Advanced Encryption Standard (AES) > 128 bitsDigital Signature: Digital Signature Algorithm (DSA) (>=2048 bits)

Diffie-hellman (DH) key exchange: DH (<= 1024 bits)Symmetric Key: BlowfishDigital Signature: Rivest-Shamir-Adleman (RSA) (>=2048 bits)

Diffie-hellman (DH) key exchange: DH (>=2048 bits)Symmetric Key: Advanced Encryption Standard (AES) < 128 bitsDigital Signature: Elliptic Curve Digital Signature Algorithm (ECDSA) (>=256 bits)

An international trading organization that holds an International Organization for Standardization (ISO) 27001 certification is seeking to outsource their security monitoring to a managed security service provider (MSSP), The trading organization's security officer is tasked with drafting the requirements that need to be included in the outsourcing contract.Which of the following MUST be included in the contract?

The right to perform security compliance tests on the MSSP's equipment

A detailed overview of all equipment involved in the outsourcing contract

The MSSP having an executive manager responsible for information security

The right to perform security compliance tests on the MSSP's equipment

The right to audit the MSSP's security process

Which of the following is the MOST effective measure for dealing with rootkit attacks?

Reinstalling the system from trusted sources

Turing off unauthorized services and rebooting the system

Finding and replacing the altered binaries with legitimate ones

Restoring the system from the last backup

Reinstalling the system from trusted sources

While classifying credit card data related to Payment Card Industry Data Security Standards (PCI-DSS), which of the following is a PRIMARY security requirement?

Processor agreements with card holders

Specific card disposal methodology

What is the MOST important factor in establishing an effective Information Security Awareness Program?

Conduct an annual security awareness event.

Hang information security posters on the walls,

Which of the following events prompts a review of the disaster recovery plan (DRP)?

New members added to the steering committee

Completion of the security policy review

An organization plans to acquire @ commercial off-the-shelf (COTS) system to replace their aging home-built reporting system. When should the organization's security team FIRST get involved in this acquisition's life cycle?

When the need for a system is expressed and the purpose of the system Is documented

When the system is being designed, purchased, programmed, developed, or otherwise constructed

When the system is verified and validated

When the system is deployed into production

When the need for a system is expressed and the purpose of the system Is documented

A developer begins employment with an information technology (IT) organization. On the first day, the developer works through the list of assigned projects and finds that some files within those projects aren't accessible, Other developers working on the same project have no trouble locating and working on the. What is the MOST likely for the discrepancy in access?

The IT administrator had failed to grant the developer privileged access to the servers.

The project files were inadvertently deleted.

The new developer's computer had not been added to an access control list (ACL).

The new developer's user account was not associated with the right roles needed for the projects.

Which of the following measures serves as the BEST means for protecting data on computers, smartphones, and external storage devices when traveling to high-risk countries?

Use multi-factor authentication (MFA) to gain access to data stored on laptops or external storage devices and biometric fingerprint access control isms to unlock smartphones.

Review applicable destination country laws, forensically clean devices prior to travel, and only download sensitive data over a virtual private network (VPN) upon arriving at the destination.

Keep laptops, external storage devices, and smartphones in the hotel room when not in use.

Leverage a Secure Socket Layer (SSL) connection over a virtual private network (VPN) to download sensitive data upon arriving at the destination.

Use multi-factor authentication (MFA) to gain access to data stored on laptops or external storage devices and biometric fingerprint access control isms to unlock smartphones.

Which of the following implementations will achieve high availability in a website?

Multiple geographically dispersed web servers that are configured for failover

Multiple Domain Name System (DNS) entries resolving to the same web server and large amounts of bandwidth

Disk mirroring of the web server with redundant disk drives in a hardened data center

Disk striping of the web server hard drives and large amounts of bandwidth

Multiple geographically dispersed web servers that are configured for failover

Which of the following is considered the FIRST step when designing an internal security control assessment?

Create a plan based on reconnaissance of the organization's infrastructure.

Create a plan based on recent vulnerability scans of the systems in question.

Create a plan based on comprehensive knowledge of known breaches.

Create a plan based on a recognized framework of known controls.

Create a plan based on reconnaissance of the organization's infrastructure.

The Chief Executive Officer (CEO) wants to implement an internal audit of the company's information security posture. The CEO wants to avoid any bias in the audit process; therefore, has assigned the Sales Director to conduct the audit.After significant interaction over a period of weeks the audit concludes that the company's policies and procedures are sufficient, robust and well established. The CEO then moves on to engage an external penetration testing company in order to showcase the organization's robust information security stance. This exercise reveals significant failings in several critical security controls and shows that the incident response processes remain undocumented.What is the MOST likely reason for this disparity in the results of the audit and the external penetration test?

The scope of the penetration test exercise and the internal audit were significantly different.

The external penetration testing company used custom zero-day attacks that could not have been predicted.

The information technology (IT) and governance teams have failed to disclose relevant information to the internal audit team leading to an incomplete assessment being formulated.

The scope of the penetration test exercise and the internal audit were significantly different.

The audit team lacked the technical experience and training to make insightful and objective assessments of the data provided to them.

An engineer notices some late collisions on a half-duplex link. The engineer verifies that the devices on both ends of the connection are configured for half duplex. Which of the following is the MOST likely cause of this issue?

The link is improperly terminated

One of the devices is misconfigured

One of the devices has a hardware issue.

To comply with industry requirements, a security assessment on the cloud server should identify which protocols and weaknesses are being exposed to attackers on the Internet. Which of the following tools is the MOST appropriate to complete the assessment?

Use nmap and set the servers' public IPs as the targets.

Use tcpdump and parse the output file in a protocol analyzer.

Use an IP scanner and target the cloud WAN network addressing

Run netstat in each cloud server and retrieve the running processes.

Use nmap and set the servers' public IPs as the targets.

Wireless users are reporting intermittent Internet connectivity. Connectivity is restored when the users disconnect and reconnect, utilizing the web authentication process each time.The network administrator can see the devices connected to the APs at all times. Which of the following steps will MOST likely determine the cause of the issue?

Verify the session time-out configuration on the captive portal settings

Check for encryption protocol mismatch on the client's wireless settings.

Confirm that a valid passphrase is being used during the web authentication.

Investigate for a client's disassociation caused by an evil twin AP

ISC CISSP Practice Test 26 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

ISC CISSP Practice Test 26

Question

ISC CISSP Practice Tests

Practice Tests