Where can the Open Web Application Security Project (OWASP) list of associated vulnerabilities be found?

OWASP Software Assurance Maturity Model (SAMM) Project

A customer continues to experience attacks on their email, web, and File Transfer Protocol (FTP) servers. These attacks are impacting their business operations. Which of the following is the BEST recommendation to make?

Configure an intrusion detection system (IDS).

Create a demilitarized zone (DMZ).

Which of the following is security control volatility?

A reference to the likelihood of change in the security control.

A reference to the stability of the security control.

A reference to how unpredictable the security control is.

A reference to the impact of the security control.

A reference to the likelihood of change in the security control.

Which of the following does the security design process ensure within the System Development Life Cycle (SDLC)?

Proper security controls, security objectives, and security goals are properly initiated.

Proper security controls, security goals, and fault mitigation are properly conducted.

Proper security controls, security objectives, and security goals are properly initiated.

Security goals, proper security controls, and validation are properly initiated.

Security objectives, security goals, and system test are properly conducted.

An organization needs a general purpose document to prove that its internal controls properly address security, availability, processing integrity, confidentiality or privacy risks. Which of the following reports is required?

A Service Organization Control (SOC) 2 report

A Service Organization Control (SOC) 3 report

The Statement on Standards for Attestation Engagements No. 18 (SSAE 18)

A Service Organization Control (SOC) 2 report

The International Organization for Standardization (ISO) 27001

What is the BEST design for securing physical perimeter protection?

Barriers, fences, gates, and walls

Crime Prevention through Environmental Design (CPTED)

Barriers, fences, gates, and walls

Business continuity planning (BCP)

Closed-circuit television (CCTV)

Two computers, each with a single connection on the same physical 10 gigabit Ethernet network segment, need to communicate with each other. The first machine has a single Internet Protocol (IP) Classless Inter-Domain Routing (CIDR) address of 192.168.1.3/30 and the second machine has an IP/CIDR address 192.168.1.6/30. Which of the following is correct?

Since each computer is on the same layer 3 network, traffic between the computers may be processed by a network bridge in order to communicate.

Since each computer is on a different layer 3 network, traffic between the computers must be processed by a network bridge in order to communicate.

Since each computer is on the same layer 3 network, traffic between the computers may be processed by a network bridge in order to communicate.

Since each computer is on the same layer 3 network, traffic between the computers may be processed by a network router in order to communicate.

Since each computer is on a different layer 3 network, traffic between the computers must be processed by a network router in order to communicate.

The security team is notified that a device on the network is infected with malware. Which of the following is MOST effective in enabling the device to be quickly located and remediated?

Information Technology Asset Management (ITAM)

Which of the following is the MOST common use of the Online Certificate Status Protocol (OCSP)?

To verify the validity of an X.509 digital certificate

To obtain the expiration date of an X.509 digital certificate

To obtain the revocation status of an X.509 digital certificate

To obtain the author name of an X.509 digital certificate

To verify the validity of an X.509 digital certificate

Why would a system be structured to isolate different classes of information from one another and segregate them by user jurisdiction?

The organization can vary its system policies to comply with conflicting national laws.

The organization can avoid e-discovery processes in the event of litigation.

The organization's infrastructure is clearly arranged and scope of responsibility is simplified.

The organization can vary its system policies to comply with conflicting national laws.

The organization is required to provide different services to various third-party organizations.

A security professional needs to find a secure and efficient method of encrypting data on an endpoint. Which solution includes a root key?

Virtual storage array network (VSAN)

What method could be used to prevent passive attacks against secure voice communications between an organization and its vendor?

Configure a virtual private network (VPN)

Configure a dedicated connection

Which of the following is a term used to describe maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions?

Information Security Continuous Monitoring (ISCM)

Information Security Management System (ISMS)

Information Sharing & Analysis Centers (ISAC)

Risk Management Framework (RMF)

Information Security Continuous Monitoring (ISCM)

Which of the following is a secure design principle for a new product?

Build in appropriate levels of fault tolerance.

Utilize obfuscation whenever possible.

Do not rely on previously used code.

Restrict the use of modularization.

What is the PRIMARY objective of the post-incident phase of the incident response process in the security operations center (SOC)?

Communicate the IR details to the stakeholders.

Validate the integrity of the IR.

An international organization has decided to use a Software as a Service (SaaS) solution to support its business operations. Which of the following compliance standards should the organization use to assess the international code security and data privacy of the solution?

Service Organization Control (SOC) 2

Health Insurance Portability and Accountability Act (HIPAA)

Service Organization Control (SOC) 2

Information Assurance Technical Framework (IATF)

A criminal organization is planning an attack on a government network. Which of the following scenarios presents the HIGHEST risk to the organization?

Organization loses control of their network devices.

Network is flooded with communication traffic by the attacker.

Organization loses control of their network devices.

Network management communications is disrupted.

Attacker accesses sensitive information regarding the network topology.

A Certified Information Systems Security Professional (CISSP) with identity and access management (IAM) responsibilities is asked by the Chief Information Security Officer (CISO) to4 perform a vulnerability assessment on a web application to pass a Payment Card Industry (PCI) audit. The CISSP has never performed this before. According to the (ISC)? Code of Professional Ethics, which of the following should the CISSP do?

Inform the CISO that they are unable to perform the task because they should render only those services for which they are fully competent and qualified

Review the CISSP guidelines for performing a vulnerability assessment before proceeding to complete it

Review the PCI requirements before performing the vulnerability assessment

Inform the CISO that they are unable to perform the task because they should render only those services for which they are fully competent and qualified

Since they are CISSP certified, they have enough knowledge to assist with the request, but will need assistance in order to complete it in a timely manner

ISC CISSP Practice Test 27 - Free Online Exam Prep & Questions

Two remote offices need to be connected securely over an untrustworthy MAN. Each office needs to access network shares at the other site. Which of the following will BEST provide this functionality?

Become a Premium Member for full access

Unlock Premium Member

ISC CISSP Practice Test 27

Question

ISC CISSP Practice Tests

Practice Tests