Which of the following is a risk matrix?

A two-dimensional picture of risk for organizations, products, projects, or other items of interest.

A database of risks associated with a specific information system.

A table of risk management factors for management to consider.

A two-dimensional picture of risk for organizations, products, projects, or other items of interest.

A tool for determining risk management decisions for an activity or system.

A user is allowed to access the file labeled "Financial Forecast," but only between 9:00 a.m. and 5:00 p.m., Monday through Friday. Which type of access mechanism should be used to accomplish this?

Limited role-based access control (RBAC)

An organization wants to share data securely with their partners via the Internet. Which standard port is typically used to meet this requirement?

Setup a server on Transmission Control Protocol (TCP) port 22

Setup a server on User Datagram Protocol (UDP) port 69

Setup a server on Transmission Control Protocol (TCP) port 21

Setup a server on Transmission Control Protocol (TCP) port 22

Setup a server on Transmission Control Protocol (TCP) port 80

What would be the BEST action to take in a situation where collected evidence was left unattended overnight in an unlocked vehicle?

Immediately report the matter to the case supervisor.

Report the matter to the local police authorities.

Move evidence to a climate-controlled environment.

Re-inventory the evidence and provide it to the evidence custodian.

Immediately report the matter to the case supervisor.

Which of the following contributes MOST to the effectiveness of a security officer?

Understanding the regulatory environment

Developing precise and practical security plans

Integrating security into the business strategies

Analyzing the strengths and weakness of the organization

An organization wants a service provider to authenticate users via the users' organization domain credentials. Which markup language should the organization's security personnel use to support the integration?

Security Assertion Markup Language (SAML)

YAML Ain't Markup Language (YAML)

Hypertext Markup Language (HTML)

Extensible Markup Language (XML)

A recent security audit is reporting several unsuccessful login attempts being repeated at specific times during the day on an Internet facing authentication server. No alerts have been generated by the security information and event management (SIEM) system. What PRIMARY action should be taken to improve SIEM performance?

Audit firewall logs to identify the source of login attempts

Implement role-based system monitoring

Audit firewall logs to identify the source of login attempts

What is a security concern when considering implementing software-defined networking (SDN)?

It has a decentralized architecture.

It increases the attack footprint.

It has a decentralized architecture.

Which of the following is the MOST important rule for digital investigations?

Ensure individual privacy is protected.

Ensure original data is never modified.

Ensure individual privacy is protected.

A cybersecurity engineer has been tasked to research and implement an ultra-secure communications channel to protect the organization's most valuable intellectual property (IP). The primary directive in this initiative is to ensure there Is no possible way the communications can be intercepted without detection. Which of the following Is the only way to ensure this 'outcome?

[Public key infrastructure (PKI)

An organization is trying to secure instant messaging (IM) communications through its network perimeter. Which of the following is the MOST significant challenge?

IM clients can run without administrator privileges.

IM clients can interoperate between multiple vendors.

IM clients can run without administrator privileges.

IM clients can utilize random port numbers.

IM clients can run as executable that do not require installation.

What is the FIRST step in developing a patch management plan?

Develop a patch testing procedure.

Subscribe to a vulnerability subscription service.

Develop a patch testing procedure.

Inventory the hardware and software used.

Identify unnecessary services installed on systems.

When resolving ethical conflicts, the information security professional MUST consider many factors.In what order should these considerations be prioritized?

Public safety, duties to the profession, duties to principals, and duties to individuals

Public safety, duties to individuals, duties to the profession, and duties to principals

Public safety, duties to principals, duties to individuals, and duties to the profession

Public safety, duties to the profession, duties to principals, and duties to individuals

Public safety, duties to principals, duties to the profession, and duties to individuals

An organization is implementing security review as part of system development. Which of the following is the BEST technique to follow?

Perform incremental assessments.

Engage a third-party auditing firm.

Perform incremental assessments.

How does Radio-Frequency Identification (RFID) assist with asset management?

It uses two-factor authentication (2FA) for system identification.

It uses biometric information for system identification.

It uses two-factor authentication (2FA) for system identification.

It transmits unique Media Access Control (MAC) addresses wirelessly.

It transmits unique serial numbers wirelessly.

Which of the following services can be deployed via a cloud service or on-premises to integrate with Identity as a Service (IDaaS) as the authoritative source of user identities?

Multi-factor authentication (MFA)

Which of the following security tools monitors devices and records the information in a central database for further analysis?

Security orchestration automation and response

Host-based intrusion detection system (HIDS)

Endpoint detection and response (EDR)

Secure coding can be developed by applying which one of the following?

Applying the industry best practice coding guidelines

Applying the organization's acceptable use guidance

Applying the industry best practice coding guidelines

Applying rapid application development (RAD) coding

Applying the organization's web application firewall (WAF) policy

A company is moving from the V model to Agile development. How can the information security department BEST ensure that secure design principles are implemented in the new methodology?

Information security requirements are captured in mandatory user stories.

All developers receive a mandatory targeted information security training.

The non-financial information security requirements remain mandatory for the new model.

The information security department performs an information security assessment after each sprint.

Information security requirements are captured in mandatory user stories.

An organization wants to define its physical perimeter. What primary device should be used to accomplish this objective if the organization's perimeter MUST cost-efficiently deter casual trespassers?

Fences eight or more feet high with three strands of barbed wire

Fences three to four feet high with a turnstile

Fences accompanied by patrolling security guards

Fences six to seven feet high with a painted gate

The acquisition of personal data being obtained by a lawful and fair means is an example of what principle?

Collection Limitation Principle

Purpose Specification Principle

Collection Limitation Principle

What is the BEST control to be implemented at a login page in a web application to mitigate the ability to enumerate users?

Implement a generic response for a failed login attempt.

Implement a strong password during account registration.

Implement numbers and special characters in the user name.

Implement two-factor authentication (2FA) to login process.

If the wide area network (WAN) is supporting converged applications like Voice over Internet Protocol (VoIP), which of the following becomes even MORE essential to the assurance of network?

Internet Protocol (IP) routing lookups

Classless Inter-Domain Routing (CIDR)

Internet Protocol (IP) routing lookups

A cloud service accepts Security Assertion Markup Language (SAML) assertions from users to on and security However, an attacker was able to spoof a registered account on the network and query the SAML provider.What is the MOST common attack leverage against this flaw?

Attacker forges requests to authenticate as a different user.

Attacker leverages SAML assertion to register an account on the security domain.

Attacker conducts denial-of-service (DoS) against the security domain by authenticating as the same user repeatedly.

Attacker exchanges authentication and authorization data between security domains.

A company is attempting to enhance the security of its user authentication processes. After evaluating several options, the company has decided to utilize Identity as a Service (IDaaS).Which of the following factors leads the company to choose an IDaaS as their solution?

In-house team lacks resources to support an on-premise solution.

In-house development provides more control.

In-house team lacks resources to support an on-premise solution.

Third-party solutions are inherently more secure.

Third-party solutions are known for transferring the risk to the vendor.

Which of the following is the BEST method to validate secure coding techniques against injection and overflow attacks?

Using automated programs to test for the latest known vulnerability patterns

Scheduled team review of coding style and techniques for vulnerability patterns

Using automated programs to test for the latest known vulnerability patterns

The regular use of production code routines from similar applications already in use

Ensure code editing tools are updated against known vulnerability patterns

A Distributed Denial of Service (DDoS) attack was carried out using malware called Mirai to create a large-scale command and control system to launch a botnet. Which of the following devices were the PRIMARY sources used to generate the attack traffic?

Internet of Things (IoT) devices

Web servers running open source operating systems (OS)

In supervisory control and data acquisition (SCADA) systems, which of the following controls can be used to reduce device exposure to malware?

Disallow untested code in the execution space of the SCADA device.

Disable all command line interfaces.

Disallow untested code in the execution space of the SCADA device.

Prohibit the use of unsecure scripting languages.

Disable Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) port 138 and 139 on the SCADA device.

What is considered a compensating control for not having electrical surge protectors installed?

Having network equipment in active-active clusters at the site

Having dual lines to network service providers built to the site

Having backup diesel generators installed to the site

Having a hot disaster recovery (DR) environment for the site

Having network equipment in active-active clusters at the site

When network management is outsourced to third parties, which of the following is the MOST effective method of protecting critical data assets?

Provide links to security policies

Log all activities associated with sensitive systems

Confirm that confidentiality agreements are signed

ISC CISSP Practice Test 31 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

ISC CISSP Practice Test 31

Question

ISC CISSP Practice Tests

Practice Tests