Which is the PRIMARY mechanism for providing the workforce with the information needed to protect an agency's vital information resources?

Incorporating security awareness and training as part of the overall information security program

An information technology (IT) security policy to preserve the confidentiality, integrity, and availability of systems

Implementation of access provisioning process for coordinating the creation of user accounts

Execution of periodic security and privacy assessments to the organization

What is the FIRST step when developing an Information Security Continuous Monitoring (ISCM) program?

Define an ISCM strategy based on risk tolerance.

Establish an ISCM technical architecture.

Collect the security-related information required for metrics, assessments, and reporting.

Establish an ISCM program determining metrics, status monitoring frequencies, and control assessment frequencies.

Define an ISCM strategy based on risk tolerance.

Which of the following minimizes damage to information technology (IT) equipment stored in a data center when a false fire alarm event occurs?

A pre-action system is installed.

Which of the following is the MOST effective corrective control to minimize the effects of a physical intrusion?

Activating bright lighting to frighten away a possible intruder

Automatic videotaping of a possible intrusion

Rapid response by guards or police to apprehend a possible intruder

Activating bright lighting to frighten away a possible intruder

Sounding a loud alarm to frighten away a possible intruder

Which type of access control includes a system that allows only users that are type=managers and department=sales to access employee records?

Role-based access control (RBAC)

Discretionary access control (DAC)

Role-based access control (RBAC)

Attribute-based access control (ABAC)

Which of the following describes the BEST method of maintaining the inventory of software and hardware within the organization?

Maintaining the inventory through a combination of on-premise storage configuration, cloud management, and partner management tools

Maintaining the inventory through a combination of desktop configuration, administration management, and procurement management tools

Maintaining the inventory through a combination of asset owner interviews, open-source system management, and open-source management tools

Maintaining the inventory through a combination of on-premise storage configuration, cloud management, and partner management tools

Maintaining the inventory through a combination of system configuration, network management, and license management tools

Which of the following is a correct feature of a virtual local area network (VLAN)?

A VLAN segregates network traffic therefore information security is enhanced significantly.

Layer 3 routing is required to allow traffic from one VLAN to another.

VLAN has certain security features such as where the devices are physically connected.

There is no broadcast allowed within a single VLAN due to network segregation.

In the "Do" phase of the Plan-Do-Check-Act model, which of the following is performed?

Ensure that business continuity policy, objectives, targets, controls, processes and procedures relevant to improving business continuity have been established.

Monitor and review performance against business continuity policy and objectives, report the results to management for review, and determine and authorize actions for remediation and improvement.

Maintain and improve the Business Continuity Management (BCM) system by taking corrective action, based on the results of management review.

Ensure the business continuity policy, controls, processes, and procedures have been implemented.

Ensure that business continuity policy, objectives, targets, controls, processes and procedures relevant to improving business continuity have been established.

Commercial off-the-shelf (COTS) software presents which of the following additional security concerns?

Exploits for COTS software are well documented and publicly available.

Vendors take on the liability for COTS software vulnerabilities.

In-house developed software is inherently less secure.

Exploits for COTS software are well documented and publicly available.

COTS software is inherently less secure.

What is the correct order of execution for security architecture?

Governance, strategy and program management, project delivery, operations

Strategy and program management, governance, project delivery, operations

Governance, strategy and program management, operations, project delivery

Strategy and program management, project delivery, governance, operations

Which of the following is the PRIMARY purpose of due diligence when an organization embarks on a merger or acquisition?

Formulate alternative strategies.

Determine that all parties are equally protected.

Provide adequate capability for all parties.

Strategy and program management, project delivery, governance, operations

What should be used to determine the risks associated with using Software as a Service (SaaS) for collaboration and email?

Cloud access security broker (CASB)

Open Web Application Security Project (OWASP)

Process for Attack Simulation and Threat Analysis (PASTA)

Common Security Framework (CSF)

A security professional has been assigned to assess a web application. The assessment report recommends switching to Security Assertion Markup Language (SAML). What is the PRIMARY security benefit in switching to SAML?

it enables single sign-on (SSO) for web applications.

It uses Transport Layer Security (TLS) to address confidentiality.

it enables single sign-on (SSO) for web applications.

The users' password Is not passed during authentication.

It limits unnecessary data entry on web forms.

Which of the following protection is provided when using a Virtual Private Network (VPN) with Authentication Header (AH)?

Multi-factor authentication (MFA)

Which of the following poses the GREATEST privacy risk to personally identifiable information (PII) when disposing of an office printer or copier?

Organizational network configuration information could still be present within the device

The device could contain a document with PII on the platen glass

Organizational network configuration information could still be present within the device

A hard disk drive (HDD) in the device could contain PII

The device transfer roller could contain imprints of PII

Which of the following is a key responsibility for a data steward assigned to manage an enterprise data lake?

Ensure proper business definition, value, and usage of data collected and stored within the enterprise data lake.

Ensure proper and identifiable data owners for each data element stored within an enterprise data lake.

Ensure adequate security controls applied to the enterprise data lake.

Ensure that any data passing within remit is being used in accordance with the rules and regulations of the business.

Which of the following are the three MAIN categories of security controls?

Administrative, technical, physical

Corrective, detective, recovery

Confidentiality, integrity, availability

Preventative, corrective, detective

What part of an organization's strategic risk assessment MOST likely includes information on items affecting the success of the organization?

Key Performance Indicator (KPI)

An organization has implemented a protection strategy to secure the network from unauthorized external access. The new Chief Information Security Officer (CISO) wants to increase security by better protecting the network from unauthorized internal access. Which Network Access Control (NAC) capability BEST meets this objective?

Two-factor authentication (2FA)

What is the BEST way to restrict access to a file system on computing systems?

Use least privilege at each level to restrict access.

Allow a user group to restrict access.

Use a third-party tool to restrict access.

Use least privilege at each level to restrict access.

During testing, where are the requirements to inform parent organizations, law enforcement, and a computer incident response team documented?

Security Assessment Report (SAR)

What is static analysis intended to do when analyzing an executable file?

Disassemble the file to gather information about the executable file's function.

Collect evidence of the executable file's usage, including dates of creation and last use.

Search the documents and files associated with the executable file.

Analyze the position of the file in the file system and the executable file's libraries.

Disassemble the file to gather information about the executable file's function.

What is the MOST important criterion that needs to be adhered to during the data collection process of an active investigation?

Capturing an image of the system

Maintaining the chain of custody

Complying with the organization's security policy

Outlining all actions taken during the investigation

What is the PRIMARY benefit of relying on Security Content Automation Protocol (SCAP)?

Standardize specifications between software security products.

Save security costs for the organization.

Improve vulnerability assessment capabilities.

Standardize specifications between software security products.

Achieve organizational compliance with international standards.

A user's credential for an application is stored in a relational database. Which control protects the confidentiality of the credential while it is stored?

Use a salted cryptographic hash of the password.

Validate passwords using a stored procedure.

Allow only the application to have access to the password field in order to verify user authentication.

Use a salted cryptographic hash of the password.

Encrypt the entire database and embed an encryption key in the application.

What is the PRIMARY consideration when testing industrial control systems (ICS) for security weaknesses?

ICS are often isolated and difficult to access.

ICS often do not have availability requirements.

ICS are often isolated and difficult to access.

ICS often run on UNIX operating systems.

ICS are often sensitive to unexpected traffic.

An organization implements Network Access Control (NAC) ay Institute of Electrical and Electronics Engineers (IEEE) 802.1x and discovers the printers do not support the IEEE 802.1x standard. Which of the following is the BEST resolution?

Implement port security on the switch ports for the printers.

Implement a virtual local area network (VLAN) for the printers.

Do nothing; IEEE 802.1x is irrelevant to printers.

Install an IEEE 802. 1x bridge for the printers.

Which of the following BEST describes why software assurance is critical in helping prevent an increase in business and mission risk for an organization?

Request for proposals (RFP) avoid purchasing software that does not meet business needs.

Software that does not perform as intended may be exploitable which makes it vulnerable to attack.

Request for proposals (RFP) avoid purchasing software that does not meet business needs.

Contracting processes eliminate liability for security vulnerabilities for the purchaser.

Decommissioning of old software reduces long-term costs related to technical debt.

In software development, which of the following entities normally signs the code to protect the code integrity?

The organization developing the code

Which security evaluation model assesses a product's Security Assurance Level (SAL) in comparison to similar solutions?

Payment Card Industry Data Security Standard (PCI-DSS)

International Organization for Standardization (ISO) 27001

Control Objectives for Information and Related Technology (COBIT)

ISC CISSP Practice Test 30 - Free Online Exam Prep & Questions

A large human resources organization wants to integrate their identity management with a trusted partner organization. The human resources organization wants to maintain the creation and management of the identities and may want to share with other partners in the future. Which of the following options BEST serves their needs?

Become a Premium Member for full access

Unlock Premium Member

ISC CISSP Practice Test 30

Question

ISC CISSP Practice Tests

Practice Tests