A system developer has a requirement for an application to check for a secure digital signature before the application is accessed on a user's laptop. Which security mechanism addresses this requirement?

Certificate revocation list (CRL) policy

The security organization is looking for a solution that could help them determine with a strong level of confidence that attackers have breached their network. Which solution is MOST effective at discovering a successful network breach?

Installing an intrusion prevention system (IPS)

Installing an intrusion detection system (IDS)

Which of the following outsourcing agreement provisions has the HIGHEST priority from a security operations perspective?

Root cause analysis for application performance issue

Conditions to prevent the use of subcontractors

Terms for contract renegotiation in case of disaster

Escalation process for problem resolution during incidents

Root cause analysis for application performance issue

When designing a Cyber-Physical System (CPS), which of the following should be a security practitioner's first consideration?

Detection of sophisticated attackers

Topology of the network used for the system

A security professional was tasked with rebuilding a company's wireless infrastructure. Which of the following are the MOST important factors to consider while making a decision on which wireless spectrum to deploy?

Existing client devices, manufacturer reputation, and electrical interference

Hybrid frequency band, service set identifier (SSID), and interpolation

Performance, geographic location, and radio signal interference

Facility size, intermodulation, and direct satellite service

Existing client devices, manufacturer reputation, and electrical interference

Which of the following is the PRIMARY goal of logical access controls?

Restrict physical access to an information asset.

Restrict access to an information asset.

Ensure integrity of an information asset.

Restrict physical access to an information asset.

Ensure availability of an information asset.

The ability to send malicious code, generally in the form of a client side script, to a different end user is categorized as which type of vulnerability?

Cross-site request forgery (CSRF)

An Internet media company produces and broadcasts highly popular television shows. The company is suffering a huge revenue loss due to piracy. What technique should be used to track the distribution of content?

Use watermarking to hide a signature into the digital media such that it can be used to find who is using the company's content.

Install the latest data loss prevention (DLP) software at every server used to distribute content.

Log user access to servers. Every day those log records are going to be audited by a team of specialized investigators.

Hire several investigators to identify sources of pirated content and report people sharing the content.

Use watermarking to hide a signature into the digital media such that it can be used to find who is using the company's content.

All hosts on the network are sending logs via syslog-ng to the log collector. The log collector is behind its own firewall, The security professional wants to make sure not to put extra load on the firewall due to the amount of traffic that is passing through it. Which of the following types of filtering would MOST likely be used?

Uniform Resource Locator (URL) Filtering

A security practitioner has been asked to model best practices for disaster recovery (DR) and business continuity. The practitioner has decided that a formal committee is needed to establish a business continuity policy. Which of the following BEST describes this stage of business continuity development?

Project Initiation and Management

Developing and Implementing business continuity plans (BCP)

What is the MOST appropriate hierarchy of documents when implementing a security program?

Standard, policy, organization principle, guideline

Organization principle, policy, standard, guideline

Policy, organization principle, standard, guideline

Standard, policy, organization principle, guideline

Organization principle, guideline, policy, standard

Which of the following is the MOST common cause of system or security failures?

Lack of physical security controls

Which access control method is based on users issuing access requests on system resources, features assigned to those resources, the operational or situational context, and a set of policies specified in terms of those features and context?

Role Based Access Control (RBAC)

Discretionary Access Control (DAC)

Attribute Based Access Control (ABAC)

Which of the following is a PRIMARY security weakness in the design of Domain Name System (DNS)?

A DNS server can be disabled in a denial-of-service (DoS) attack.

A DNS server does not authenticate source of information.

Each DNS server must hold the address of the root servers.

A DNS server database can be injected with falsified checksums.

Which of the following BEST describes the purpose of the reference monitor when defining access control to enforce the security model?

Policies to validate organization rules

Quality design principles to ensure quality by design

Policies to validate organization rules

Cyber hygiene to ensure organizations can keep systems healthy

Strong operational security to keep unit members safe

Which of the following protects personally identifiable information (PII) used by financial services organizations?

National Institute of Standards and Technology (NIST) SP 800-53

Payment Card Industry Data Security Standard (PCI-DSS)

Health Insurance Portability and Accountability Act (HIPAA)

Which of the following is a common term for log reviews, synthetic transactions, and code reviews?

Spiral development functional testing

DevOps Integrated Product Team (IPT) development

Clothing retailer employees are provisioned with user accounts that provide access to resources at partner businesses. All partner businesses use common identity and access management (IAM) protocols and differing technologies. Under the Extended Identity principle, what is the process flow between partner businesses to allow this TAM action?

Clothing retailer acts as identity provider (IdP), confirms identity of user using industry standards, then sends credentials to partner businesses that act as a Service Provider and allows access to services.

Clothing retailer acts as User Self Service, confirms identity of user using industry standards, then sends credentials to partner businesses that act as a Service Provider and allows access to services.

Clothing retailer acts as Service Provider, confirms identity of user using industry standards, then sends credentials to partner businesses that act as an identity provider (IdP) and allows access to resources.

Clothing retailer acts as Access Control Provider, confirms access of user using industry standards, then sends credentials to partner businesses that act as a Service Provider and allows access to resources.

What is the benefit of using Network Admission Control (NAC)?

NAC can require the use of certificates, passwords, or a combination of both before allowing network admission.

Operating system (OS) versions can be validated prior to allowing network access.

NAC supports validation of the endpoint's security posture prior to allowing the session to go into an authorized state.

NAC can require the use of certificates, passwords, or a combination of both before allowing network admission.

NAC only supports Windows operating systems (OS).

The European Union (EU) General Data Protection Regulation (GDPR) requires organizations to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The Data Owner should therefore consider which of the following requirements?

Never to store personal data of EU citizens outside the EU

Data masking and encryption of personal data

Only to use encryption protocols approved by EU

Anonymization of personal data when transmitted to sources outside the EU

Never to store personal data of EU citizens outside the EU

Which of the following is the BEST approach to implement multiple servers on a virtual system?

Implement one primary function per virtual server and apply individual security configuration for each virtual server.

Implement multiple functions per virtual server and apply the same security configuration for each virtual server.

Implement one primary function per virtual server and apply high security configuration on the host operating system.

Implement one primary function per virtual server and apply individual security configuration for each virtual server.

Implement multiple functions within the same virtual server and apply individual security configurations to each function.

Which of the following is the MOST important consideration in selecting a security testing method based on different Radio-Frequency Identification (RFID) vulnerability types?

An understanding of the attack surface

The performance and resource utilization of tools

The quality of results and usability of tools

An understanding of the attack surface

Adaptability of testing tools to multiple technologies

A financial services organization has employed a security consultant to review processes used by employees across various teams. The consultant interviewed a member of the application development practice and found gaps in their threat model. Which of the following correctly represents a trigger for when a threat model should be revised?

A new developer is hired into the team.

A new data repository is added.

is After operating system (OS) patches are applied

After a modification to the firewall rule policy

A new developer is hired into the team.

When testing password strength, which of the following is the BEST method for brute forcing passwords?

Use a comprehensive list of words to attempt to guess the password.

Conduct an offline attack on the hashed password information.

Conduct an online password attack until the account being used is locked.

Use a comprehensive list of words to attempt to guess the password.

Use social engineering methods to attempt to obtain the password.

What is a use for mandatory access control (MAC)?

Allows for object security based on sensitivity represented by a label

Allows for labeling of sensitive user accounts for access control

Allows for mandatory user identity and passwords based on sensitivity

Allows for mandatory system administrator access control over objects

Allows for object security based on sensitivity represented by a label

Which of the following MUST be done before a digital forensics investigator may acquire digital evidence?

Verify that the investigator has the appropriate legal authority to proceed.

Inventory the digital evidence.

Verify that the investigator has the appropriate legal authority to proceed.

Perform hashing to verify the integrity of the digital evidence.

A security engineer is required to integrate security into a software project that is implemented by small groups test quickly, continuously, and independently develop, test, and deploy code to the cloud. The engineer will MOST likely integrate with which software development process'

Structured Waterfall Programming Development

Service-oriented architecture (SOA)

Structured Waterfall Programming Development

Devops Integrated Product Team (IPT)

ISC CISSP Practice Test 32 - Free Online Exam Prep & Questions

What is the FIRST step in reducing the exposure of a network to Internet Control Message Protocol (ICMP) based attacks?

Become a Premium Member for full access

Unlock Premium Member

ISC CISSP Practice Test 32

Question

ISC CISSP Practice Tests

Practice Tests