Which of the following is an example of a vulnerability of full-disk encryption (FDE)?

Data at rest has been compromised when the user has authenticated to the device.

Data on the device cannot be restored from backup.

Data in transit has been compromised when the user has authenticated to the device.

Data on the device cannot be backed up.

What is the PRIMARY purpose of creating and reporting metrics for a security awareness, training, and education program?

Facilitate supervision of periodic training events.

Make all stakeholders aware of the program's progress.

Measure the effect of the program on the organization's workforce.

Facilitate supervision of periodic training events.

Comply with legal regulations and document due diligence in security practices.

Which one of the following BEST protects vendor accounts that are used for emergency maintenance?

Vendor access should be disabled until needed

Role-based access control (RBAC)

Frequent monitoring of vendor access

To minimize the vulnerabilities of a web-based application, which of the following FIRST actions will lock down the system and minimize the risk of an attack?

Apply the latest vendor patches and updates

Install an antivirus on the server

Apply the latest vendor patches and updates

A hospital has allowed virtual private networking (VPN) access to remote database developers. Upon auditing the internal firewall configuration, the network administrator discovered that split-tunneling was enabled. What is the concern with this configuration?

Multiple Internet Protocol Security (IPSec) tunnels may be exploitable in specific circumstances.

Remote sessions will not require multi-layer authentication.

Remote clients are permitted to exchange traffic with the public and private network.

Multiple Internet Protocol Security (IPSec) tunnels may be exploitable in specific circumstances.

The network intrusion detection system (NIDS) will fail to inspect Secure Sockets Layer (SSL) traffic.

What action should be taken by a business line that is unwilling to accept the residual risk in a system after implementing compensating controls?

Purchase insurance to cover the residual risk.

Notify the audit committee of the situation.

Purchase insurance to cover the residual risk.

Implement operational safeguards.

Find another business line willing to accept the residual risk.

Which of the following BEST represents a defense in depth concept?

Endpoint security management, network intrusion detection system (NIDS), Network Access Control (NAC), Privileged Access Management (PAM), security information and event management (SIEM)

Network-based data loss prevention (DLP), Network Access Control (NAC), network-based Intrusion prevention system (NIPS), Port security on core switches

Host-based data loss prevention (DLP), Endpoint anti-malware solution, Host-based integrity checker, Laptop locks, hard disk drive (HDD) encryption

Endpoint security management, network intrusion detection system (NIDS), Network Access Control (NAC), Privileged Access Management (PAM), security information and event management (SIEM)

Web application firewall (WAF), Gateway network device tuning, Database firewall, Next- Generation Firewall (NGFW), Tier-2 demilitarized zone (DMZ) tuning

Which of the following statements BEST distinguishes a stateful packet inspection firewall from a stateless packet filter firewall?

The SPI inspects the traffic in the context of a session.

The SPI inspects the flags on Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) packets.

The SPI inspects the traffic in the context of a session.

The SPI is capable of dropping packets based on a pre-defined rule set.

The SPI inspects traffic on a packet-by-packet basis.

An organization has developed a way for customers to share information from their wearable devices with each other. Unfortunately, the users were not informed as to what information collected would be shared. What technical controls should be put in place to remedy the privacy issue while still trying to accomplish the organization's business goals?

Stop sharing data with the other users.

Default the user to not share any information.

Inform the user of the sharing feature changes after implemented.

Share only what the organization decides is best.

Stop sharing data with the other users.

Which algorithm gets its security from the difficulty of calculating discrete logarithms in a finite field and is used to distribute keys, but cannot be used to encrypt or decrypt messages?

Digital Signature Algorithm (DSA)

Which Wide Area Network (WAN) technology requires the first router in the path to determine the full path the packet will travel, removing the need for other routers in the path to make independent determinations?

Multiprotocol Label Switching (MPLS)

Synchronous Optical Networking (SONET)

Session Initiation Protocol (SIP)

Fiber Channel Over Ethernet (FCoE)

An organization recently suffered from a web-application attack that resulted in stolen user session cookie information. The attacker was able to obtain the information when a user's browser executed a script upon visiting a compromised website. What type of attack MOST likely occurred?

Extensible Markup Language (XML) external entities

Cross-Site Request Forgery (CSRF)

An organization recently upgraded to a Voice over Internet Protocol (VoIP) phone system.Management is concerned with unauthorized phone usage. security consultant is responsible for putting together a plan to secure these phones. Administrators have assigned unique personal identification number codes for each person in the organization. What is the BEST solution?

Have the administrator enforce a policy to change the PIN regularly. Implement call detail records (CDR) reports to track usage.

Use phone locking software to enforce usage and PIN policies.

Inform the user to change the PIN regularly. Implement call detail records (CDR) reports to track usage.

Have the administrator enforce a policy to change the PIN regularly. Implement call detail records (CDR) reports to track usage.

Have the administrator change the PIN regularly. Implement call detail records (CDR) reports to track usage.

Which of the following regulations dictates how data breaches are handled?

General Data Protection Regulation (GDPR)

National Institute of Standards and Technology (NIST)

Payment Card Industry Data Security Standard (PCI-DSS)

General Data Protection Regulation (GDPR)

Which of the following is fundamentally required to address potential security issues when initiating software development?

Add information security objectives into development.

Implement ongoing security audits in all environments.

Ensure isolation of development from production.

Add information security objectives into development.

Conduct independent source code review.

Which of the following addresses requirements of security assessments during software acquisition?

Software configuration management (SCM)

Data loss prevention (DLP) policy

Which of the following BEST obtains an objective audit of security controls?

The security audit is measured against a known standard.

The security audit is performed by a certified internal auditor.

The security audit is performed by an independent third-party.

The security audit produces reporting metrics for senior leadership.

Which of the following is established to collect information Se eee ee ee nation readily available in part through implemented security controls?

Security Assessment Report (SAR)

Information Security Continuous Monitoring (ISCM)

In order to provide dual assurance in a digital signature system, the design MUST include which of the following?

signature process must generate adequate authentication credentials.

The public key must be unique for the signed document.

signature process must generate adequate authentication credentials.

The hash of the signed document must be present.

The encrypted private key must be provided in the signing certificate.

Which of the following attacks, if successful, could give an intruder complete control of a softwaredefined networking (SDN) architecture?

Sending control messages to open a flow that does not pass a firewall from a compromised host within the network

Sniffing the traffic of a compromised host inside the network

Sending control messages to open a flow that does not pass a firewall from a compromised host within the network

A brute force password attack on the Secure Shell (SSH) port of the controller

Remote Authentication Dial-In User Service (RADIUS) token replay attack

What are the three key benefits that application developers should derive from the northbound application programming interface (API) of software defined networking (SDN)?

Network syntax, abstraction of network commands, and abstraction of network protocols

Familiar syntax, abstraction of network topology, and definition of network protocols

Network syntax, abstraction of network flow, and abstraction of network protocols

Network syntax, abstraction of network commands, and abstraction of network protocols

Familiar syntax, abstraction of network topology, and abstraction of network protocols

What security principle addresses the issue of "Security by Obscurity"?

Role Based Access Control (RBAC)

In Federated Identity Management (FIM), which of the following represents the concept of federation?

Collection of domains that have established trust among themselves

Collection of information logically grouped into a single entity

Collection, maintenance, and deactivation of user objects and attributes in one or more systems, directories or applications

Collection of information for common identities in a system

Collection of domains that have established trust among themselves

Which of the following vulnerability assessment activities BEST exemplifies the Examine method of assessment?

Logging into a web server using the default administrator account and a default password

Ensuring that system audit logs capture all relevant data fields required by the security controls baseline

Performing Port Scans of selected network hosts to enumerate active services

Asking the Information System Security Officer (ISSO) to describe the organization's patch management processes

Logging into a web server using the default administrator account and a default password

Which of the following is the MOST appropriate control for asset data labeling procedures?

Categorizing the types of media being used

Logging data media to provide a physical inventory control

Reviewing audit trails of logging records

Categorizing the types of media being used

Reviewing off-site storage access controls

ISC CISSP Practice Test 33 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

ISC CISSP Practice Test 33

Question

ISC CISSP Practice Tests

Practice Tests