What BEST describes the confidentiality, integrity, availability triad?

The implementation of security systems to protect the organization's data

A tool used to assist in understanding how to protect the organization's data

The three-step approach to determine the risk level of an organization

The implementation of security systems to protect the organization's data

A vulnerability assessment to see how well the organization's data is protected

When developing an external facing web-based system, which of the following would be the MAIN focus of the security assessment prior to implementation and production?

Ensuring Secure Sockets Layer (SSL) certificates are signed by a certificate authority

Assessing the Uniform Resource Locator (URL)

Ensuring Secure Sockets Layer (SSL) certificates are signed by a certificate authority

Ensuring that input validation is enforced

Ensuring Secure Sockets Layer (SSL) certificates are internally signed

In an environment where there is not full administrative control over all network connected endpoints, such as a university where non-corporate devices are used, what is the BEST way to restrict access to the network?

Use switch port security to limit devices connected to a particular switch port.

Use of virtual local area networks (VLAN) to segregate users.

Use a client-based Network Access Control (NAC) solution.

Use a clientless Network Access Control (NAC) solution

Which of the following threats would be MOST likely mitigated by monitoring assets containing open source libraries for vulnerabilities?

Distributed denial-of-service (DDoS) attack

Advanced persistent threat (APT) attempt

A company needs to provide employee access to travel services, which are hosted by a third-party service provider, Employee experience is important, and when users are already authenticated, access to the travel portal is seamless.Which of the following methods is used to share information and grant user access to the travel portal?

Security Assertion Markup Language (SAML) access

Open Authorization (OAuth) access

Why is data classification control important to an organization?

To ensure its integrity, confidentiality and availability

To control data retention in alignment with organizational policies and regulation

To ensure security controls align with organizational risk appetite

Which of the following is the strongest physical access control?

Biometrics, a password, and badge reader

Biometrics, a password, and personal identification number (PIN)

Individual password for each user

Biometrics, a password, and badge reader

While dealing with the consequences of a security incident, which of the following security controls are MOST appropriate?

Preventative and corrective controls

Detective and recovery controls

Corrective and recovery controls

Preventative and corrective controls

Recovery and proactive controls

A Chief Information Security Officer (CISO) of a firm which decided to migrate to cloud has been tasked with ensuring an optimal level of security. Which of the following would be the FIRST consideration?

Define the cloud migration roadmap and set out which applications and data repositories should be moved into the cloud.

Ensure that the contract between the cloud vendor and the firm clearly defines responsibilities for operating security controls.

Analyze the firm's applications and data repositories to determine the relevant control requirements.

Request a security risk assessment of the cloud vendor be completed by an independent third- party.

What is the MOST important goal of conducting security assessments?

To discover unmitigated security vulnerabilities, and propose paths for mitigating them

To prepare the organization for an external audit, particularly by a regulatory entity

To discover unmitigated security vulnerabilities, and propose paths for mitigating them

To align the security program with organizational risk appetite

To demonstrate proper function of security controls and processes to senior management

A hospital's building controls system monitors and operates the environmental equipment to maintain a safe and comfortable environment. Which of the following could be used to minimize the risk of utility supply interruption?

Digital protection and control devices capable of minimizing the adverse impact to critical utility

Digital devices that can turn equipment off and continuously cycle rapidly in order to increase supplies and conceal activity on the hospital network

Standardized building controls system software with high connectivity to hospital networks

Lock out maintenance personnel from the building controls system access that can impact critical utility supplies

Digital protection and control devices capable of minimizing the adverse impact to critical utility

To monitor the security of buried data lines inside the perimeter of a facility, which of the following is the MOST effective control?

regular sweeps of the perimeter, including manual inspection of the cable ingress points

Fencing around the facility with closed-circuit television (CCTV) cameras at all entry points

Ground sensors installed and reporting to a security event management (SEM) system

Steel casing around the facility ingress points

regular sweeps of the perimeter, including manual inspection of the cable ingress points

What is the BEST method to use for assessing the security impact of acquired software?

Software security compliance validation

Which of the following is the MOST effective way to ensure the endpoint devices used by remote users are compliant with an organization's approved policies before being allowed on the network?

Privileged Access Management (PAM)

Which of the following factors should be considered characteristics of Attribute Based Access Control (ABAC) in terms of the attributes used?

Role Based Access Control (RBAC) and Access Control List (ACL)

Mandatory Access Control (MAC) and Discretionary Access Control (DAC)

Discretionary Access Control (DAC) and Access Control List (ACL)

Role Based Access Control (RBAC) and Mandatory Access Control (MAC)

Role Based Access Control (RBAC) and Access Control List (ACL)

A security architect is developing an information system for a client. One of the requirements is to deliver a platform that mitigates against common vulnerabilities and attacks, What is the MOST efficient option used to prevent buffer overflow attacks?

Address Space Layout Randomization (ASLR)

Which of the following should be done at a disaster site before any item is removed, repaired, or replaced?

Notify all of the Board of Directors

Communicate with the press following the communications plan

Dispatch personnel to the disaster recovery (DR) site

What is the FIRST step in risk management?

Establish the scope and actions required.

Establish the expectations of stakeholder involvement.

Identify the factors that have potential to impact business.

Establish the scope and actions required.

Identify existing controls in the environment.

Which element of software supply chain management has the GREATEST security risk to organizations?

Unsupported libraries are often used.

New software development skills are hard to acquire.

Unsupported libraries are often used.

Applications with multiple contributors are difficult to evaluate.

Vulnerabilities are difficult to detect.

A colleague who recently left the organization asked a security professional for a copy of the organization's confidential incident management policy. Which of the following is the BEST response to this request?

Do not acknowledge receiving the request from the former colleague and ignore them.

Email the policy to the colleague as they were already part of the organization and familiar with it.

Do not acknowledge receiving the request from the former colleague and ignore them.

Access the policy on a company-issued device and let the former colleague view the screen.

Submit the request using company official channels to ensure the policy is okay to distribute.

An enterprise is developing a baseline cybersecurity standard its suppliers must meet before being awarded a contract. Which of the following statements is TRUE about the baseline cybersecurity standard?

It should be expressed as technical requirements.

It should be expressed as general requirements.

It should be expressed in legal terminology.

It should be expressed in business terminology.

It should be expressed as technical requirements.

Which of the following is the MOST effective strategy to prevent an attacker from disabling a network?

Follow security guidelines to prevent unauthorized network access.

Test business continuity and disaster recovery (DR) plans.

Design networks with the ability to adapt, reconfigure, and fail over.

Implement network segmentation to achieve robustness.

Follow security guidelines to prevent unauthorized network access.

Which of the following features is MOST effective in mitigating against theft of data on a corporate mobile device which has been stolen?

Mobile Device Management (MDM) with device wipe

Whole device encryption with key escrow

Virtual private network (VPN) with traffic encryption

Mobile device tracking with geolocation

An organization is implementing data encryption using symmetric ciphers and the Chief Information Officer (CIO) is concerned about the risk of using one key to protect all sensitive data, The security practitioner has been tasked with recommending a solution to address the CIO's concerns, Which of the following is the BEST approach to achieving the objective by encrypting all sensitive data?

Use Rivest-Shamir-Adleman (RSA) keys.

Use a Secure Hash Algorithm 256 (SHA-256).

Use a hierarchy of encryption keys.

Use Hash Message Authentication Code (HMAC) keys.

Use Rivest-Shamir-Adleman (RSA) keys.

International bodies established a regulatory scheme that defines how weapons are exchanged between the signatories. It also addresses cyber weapons, including malicious software, Command and Control (C2) software, and internet surveillance software. This is a description of which of the following?

General Data Protection Regulation (GDPR)

International Traffic in Arms Regulations (ITAR)

Which of the following BEST describes when an organization should conduct a black box security audit on a new software product?

When the organization wants to enumerate known security vulnerabilities across their infrastructure

When the organization wishes to check for non-functional compliance

When the organization wants to enumerate known security vulnerabilities across their infrastructure

When the organization has experienced a security incident

When the organization is confident the final source code is complete

The Chief Information Officer (CIO) has decided that as part of business modernization efforts the organization will move towards a cloud architecture. All business-critical data will be migrated to either internal or external cloud services within the next two years. The CIO has a PRIMARY obligation to work with personnel in which role in order to ensure proper protection of data during and after the cloud migration?

Chief Information Security Officer (CISO)

Which of the following is a unique feature of attribute-based access control (ABAC)?

A user is granted access to a system at a particular time of day.

A user is granted access to a system based on group affinity.

A user is granted access to a system with biometric authentication.

A user is granted access to a system at a particular time of day.

A user is granted access to a system based on username and password.

ISC CISSP Practice Test 34 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

ISC CISSP Practice Test 34

Question

ISC CISSP Practice Tests

Practice Tests