A healthcare insurance organization chose a vendor to develop a software application. Upon review of the draft contract, the information security professional notices that software security is not addressed. What is the BEST approach to address the issue?

Update the contract so that the vendor is obligated to provide security capabilities.

Update the service level agreement (SLA) to provide the organization the right to audit the vendor.

Update the service level agreement (SLA) to require the vendor to provide security capabilities.

Update the contract so that the vendor is obligated to provide security capabilities.

Update the contract to require the vendor to perform security code reviews.

Which of the following is MOST important to follow when developing information security controls for an organization?

Use industry standard best practices for security controls in the organization.

Exercise due diligence with regard to all risk management information to tailor appropriate controls.

Perform a risk assessment and choose a standard that addresses existing gaps.

Use industry standard best practices for security controls in the organization.

Review all local and international standards and choose the most stringent based on location.

Which of the following is the MAIN difference between a network-based firewall and a host-based firewall?

A network-based firewall controls traffic passing through the device, while a host-based firewall controls traffic destined for the device.

A network-based firewall is stateful, while a host-based firewall is stateless.

A network-based firewall controls traffic passing through the device, while a host-based firewall controls traffic destined for the device.

A network-based firewall verifies network traffic, while a host-based firewall verifies processes and applications.

A network-based firewall blocks network intrusions, while a host-based firewall blocks malware.

Building blocks for software-defined networks (SDN) require which of the following?

Virtual memory is used in preference to random-access memory (RAM).

The SDN is mostly composed of virtual machines (VM).

The SDN is composed entirely of client-server pairs.

Virtual memory is used in preference to random-access memory (RAM).

Random-access memory (RAM) is used in preference to virtual memory.

An organization outgrew its internal data center and is evaluating third-party hosting facilities. In this evaluation, which of the following is a PRIMARY factor for selection?

Facility provides the most cost-effective solution

Facility provides an acceptable level of risk

Facility provides disaster recovery (DR) services

Facility provides the most cost-effective solution

Facility has physical access protection measures

A company is planning to implement a private cloud infrastructure. Which of the following recommendations will support the move to a cloud infrastructure?

implement software-defined networking (SDN) to provide the ability to apply high-level policies to shape and reorder network traffic based on users, devices and applications.

Implement a virtual local area network (VLAN) for each department and create a separate subnet for each VLAN.

Implement software-defined networking (SDN) to provide the ability for the network infrastructure to be integrated with the control and data planes.

Implement a virtual local area network (VLAN) to logically separate the local area network (LAN) from the physical switches.

implement software-defined networking (SDN) to provide the ability to apply high-level policies to shape and reorder network traffic based on users, devices and applications.

While performing a security review for a new product, an information security professional discovers that the organization's product development team is proposing to collect government-issued identification (ID) numbers from customers to use as unique customer identifiers. Which of the following recommendations should be made to the product development team?

Customer identifiers should be a cryptographic hash of the user's government-issued ID number.

Customer identifiers should be a variant of the user's government-issued ID number.

Customer identifiers that do not resemble the user's government-issued ID number should be used.

Customer identifiers should be a cryptographic hash of the user's government-issued ID number.

Customer identifiers should be a variant of the user's name, for example, "jdoe" or "john.doe."

Which of the following is performed to determine a measure of success of a security awareness training program designed to prevent social engineering attacks?

Internal assessment of the training program's effectiveness

Employee evaluation of the training program

Internal assessment of the training program's effectiveness

Multiple choice tests to participants

A retail company is looking to start a development project that will utilize open source components in its code for the first time. The development team has already acquired several 'open source components and utilized them in proof of concept (POC) code. The team recognizes that the legal and operational risks are outweighed by the benefits of open-source software use. What MUST the organization do next?

Establish an open-source compliance policy.

Mandate that all open-source components be approved by the Information Security Manager (ISM).

Scan all open-source components for security vulnerabilities.

Establish an open-source compliance policy.

Require commercial support for all open-source components.

Upon commencement of an audit within an organization, which of the following actions is MOST important for the auditor(s) to take?

Meet with stakeholders to review methodology, people to be interviewed, and audit scope.

Understand circumstances which may delay the overall audit timelines.

Review all prior audit results to remove all areas of potential concern from the audit scope.

Meet with stakeholders to review methodology, people to be interviewed, and audit scope.

Meet with stakeholders to understand which types of audits have been completed.

An organization has discovered that organizational data is posted by employees to data storage accessible to the general public. What is the PRIMARY step an organization must take to ensure data is properly protected from public release?

Implement a user training policy.

Implement a data classification policy.

Implement a data encryption policy.

Implement a user training policy.

Implement a user reporting policy.

What is the PRIMARY reason that a bit-level copy is more desirable than a file-level copy when replicating a hard drive's contents for an e-discovery investigation?

Files that have been deleted will be transferred.

The file and directory structure is retained.

File-level security settings will be preserved.

The corruption of files is less likely.

A large manufacturing organization arranges to buy an industrial machine system to produce a new line of products. The system includes software provided to the vendor by a thirdparty organization.The financial risk to the manufacturing organization starting production is high. What step should the manufacturing organization take to minimize its financial risk in the new venture prior to the purchase?

Calculate the possible loss in revenue to the organization due to software bugs and vulnerabilities, and compare that to the system's overall price.

Hire a performance tester to execute offline tests on a system.

Calculate the possible loss in revenue to the organization due to software bugs and vulnerabilities, and compare that to the system's overall price.

Place the machine behind a Layer 3 firewall.

Require that the software be thoroughly tested by an accredited independent software testing company.

Which of the following types of hosts should be operating in the demilitarized zone (DMZ)?

Hosts intended to provide limited access to public resources

Database servers that can provide useful information to the public

Hosts that store unimportant data such as demographical information

File servers containing organizational data

In systems security engineering, what does the security principle of modularity provide?

Secure distribution of programs and data

Minimal access to perform a function

Which of the following is required to verify the authenticity of a digitally signed document?

Digital hash of the signed document

Who should perform the design review to uncover security design flaws as part of the Software Development Life Cycle (SDLC)?

security subject matter expert (SME)

A developer subject matter expert (SME)

During a penetration test, what are the three PRIMARY objectives of the planning phase?

Identify rules of engagement, document management approval, and collect system and application information.

Determine testing goals, identify rules of engagement, and conduct an initial discovery scan.

Finalize management approval, determine testing goals, and gather port and service information.

Identify rules of engagement, finalize management approval, and determine testing goals.

Identify rules of engagement, document management approval, and collect system and application information.

The security architect is designing and implementing an internal certification authority to generate digital certificates for all employees. Which of the following is the BEST solution to securely store the private keys?

Public key infrastructure (PKI)

Physically secured storage device

Public key infrastructure (PKI)

Which of the following is a common risk with fiber optical communications, and what is the associated mitigation measure?

Light leakage, deploying shielded cable wherever feasible

Data emanation, deploying Category (CAT) 6 and higher cable wherever feasible

Light leakage, deploying shielded cable wherever feasible

Cable damage, deploying ring architecture wherever feasible

Electronic eavesdropping, deploying end-to-end encryption wherever feasible

What is the BEST reason to include supply chain risks in a corporate risk register?

Risk registers classify and categorize risk and allow risks to be compared to corporate risk appetite.

Risk registers help fund corporate supply chain risk management (SCRM) systems.

Risk registers classify and categorize risk and allow risks to be compared to corporate risk appetite.

Risk registers can be used to illustrate residual risk across the company.

Risk registers allow for the transfer of risk to third parties.

An employee's home address should be categorized according to which of the following references?

The organization's data classification model

The consent form terms and conditions signed by employees

The organization's data classification model

Existing employee data classifications

An organization security plan for human resources

Why is authentication by ownership stronger than authentication by knowledge?

It can be kept on the user's person.

It is more difficult to duplicate.

A network security engineer needs to ensure that a security solution analyzes traffic for protocol manipulation and various sorts of common attacks. In addition, all Uniform Resource Locator (URL) traffic must be inspected and users prevented from browsing inappropriate websites. Which of the following solutions should be implemented to enable administrators the capability to analyze traffic, blacklist external sites, and log user traffic for later analysis?

Intrusion detection system (IDS)

Which of the following is the BEST way to protect an organization's data assets?

Encrypt data in transit and at rest using up-to-date cryptographic algorithms.

Monitor and enforce adherence to security policies.

Encrypt data in transit and at rest using up-to-date cryptographic algorithms.

Create the Demilitarized Zone (DMZ) with proxies, firewalls and hardened bastion hosts.

Require Multi-Factor Authentication (MFA) and Separation of Duties (SoD).

Which of the following would qualify as an exception to the "right to be forgotten" of the General Data Protection Regulation's (GDPR)?

The personal data remains necessary to the purpose for which it was collected

For the establishment, exercise, or defense of legal claims

The personal data has been lawfully processed and collected

The personal data remains necessary to the purpose for which it was collected

For the reasons of private interest

What is the MINIMUM standard for testing a disaster recovery plan (DRP)?

As often as necessary depending upon the stability of the environment and business requirements

Semi-annually and in alignment with a fiscal half-year business cycle

Annually or less frequently depending upon audit department requirements

Quarterly or more frequently depending upon the advice of the information security manager

As often as necessary depending upon the stability of the environment and business requirements

What is the MOST significant benefit of role-based access control (RBAC)?

Reduction in authorization administration overhead

Most granular form of access control

ISC CISSP Practice Test 28 - Free Online Exam Prep & Questions

A large organization's human resources and security teams are planning on implementing technology to eliminate manual user access reviews and improve compliance. Which of the following options is MOST likely to resolve the issues associated with user access?

Become a Premium Member for full access

Unlock Premium Member

ISC CISSP Practice Test 28

Question

ISC CISSP Practice Tests

Practice Tests