Copyright provides protection for which of the following?

A particular expression of an idea

Ideas expressed in literary works

A particular expression of an idea

Discoveries of natural phenomena

Which of the following is TRUE about Disaster Recovery Plan (DRP) testing?

Testing should continue even if components of the test fail.

Operational networks are usually shut down during testing.

Testing should continue even if components of the test fail.

The company is fully prepared for a disaster if all tests pass.

Testing should not be done until the entire disaster plan can be tested.

Which of the following is the FIRST step of a penetration test plan?

Obtaining the approval of the company's management

Analyzing a network diagram of the target network

Notifying the company's customers

Obtaining the approval of the company's management

Scheduling the penetration test during a period of least impact

Which of the following actions should be performed when implementing a change to a database schema in a production system?

Change in development, perform user acceptance testing, develop a back-out strategy, and implement change

Test in development, determine dates, notify users, and implement in production

Apply change to production, run in parallel, finalize change in production, and develop a back-out strategy

Perform user acceptance testing in production, have users sign off, and finalize change

Change in development, perform user acceptance testing, develop a back-out strategy, and implement change

The BEST method of demonstrating a company's security level to potential customers is

a report from an external auditor.

responding to a customer's security questionnaire.

a formal report from an internal auditor.

a site visit by a customer's security team.

Which of the following does Temporal Key Integrity Protocol (TKIP) support?

Wired Equivalent Privacy (WEP) systems

Multicast and broadcast messages

Coordination of IEEE 802.11 protocols

Wired Equivalent Privacy (WEP) systems

Synchronization of multiple devices

The stringency of an Information Technology (IT) security assessment will be determined by the

sensitivity of the system's datA.

What should be the INITIAL response to Intrusion Detection System/Intrusion Prevention System (IDS/IPS) alerts?

Verify the threat and determine the scope of the attack.

Ensure that the Incident Response Plan is available and current.

Determine the traffic's initial source and block the appropriate port.

Disable or disconnect suspected target and source systems.

Verify the threat and determine the scope of the attack.

Checking routing information on e-mail to determine it is in a valid format and contains valid information is an example of which of the following anti-spam approaches?

Simple Mail Transfer Protocol (SMTP) blacklist

Reverse Domain Name System (DNS) lookup

During an audit of system management, auditors find that the system administrator has not been trained. What actions need to be taken at once to ensure the integrity of systems?

A review of all systems by an experienced administrator

A review of hiring policies and methods of verification of new employees

A review of all departmental procedures

A review of all training procedures to be undertaken

A review of all systems by an experienced administrator

An internal Service Level Agreement (SLA) covering security is signed by senior managers and is in place. When should compliance to the SLA be reviewed to ensure that a good security posture is being delivered?

At regularly scheduled meetings

As part of the SLA renewal process

Prior to a planned security audit

Immediately after a security breach

At regularly scheduled meetings

Which of the following is the best practice for testing a Business Continuity Plan (BCP)?

Test after installation of security patches

Test after implementation of system patches

Which of the following MUST be done when promoting a security awareness program to senior management?

Explain how hackers have enhanced information security

Show the need for security; identify the message and the audience

Ensure that the security presentation is designed to be all-inclusive

Notify them that their compliance is mandatory

Explain how hackers have enhanced information security

Which of the following is a security feature of Global Systems for Mobile Communications (GSM)?

It uses a Subscriber Identity Module (SIM) for authentication.

It uses encrypting techniques for all communications.

The radio spectrum is divided with multiple frequency carriers.

The signal is difficult to read as it provides end-to-end encryption.

A disadvantage of an application filtering firewall is that it can lead to

performance degradation due to the rules applied.

a crash of the network as a result of user activities.

performance degradation due to the rules applied.

loss of packets on the network due to insufficient bandwidth.

Internet Protocol (IP) spoofing by hackers.

What is the MOST important purpose of testing the Disaster Recovery Plan (DRP)?

Validating the effectiveness of the plan

Evaluating the efficiency of the plan

Identifying the benchmark required for restoration

Validating the effectiveness of the plan

Determining the Recovery Time Objective (RTO)

Following the completion of a network security assessment, which of the following can BEST be demonstrated?

The effectiveness of controls can be accurately measured

A penetration test of the network will fail

The network is compliant to industry standards

All unpatched vulnerabilities have been identified

Passive Infrared Sensors (PIR) used in a non-climate controlled environment should

automatically compensate for variance in background temperature.

reduce the detected object temperature in relation to the background temperature.

increase the detected object temperature in relation to the background temperature.

automatically compensate for variance in background temperature.

detect objects of a specific temperature independent of the background temperature.

An organization is selecting a service provider to assist in the consolidation of multiple computing sites including development, implementation and ongoing support of various computer systems.Which of the following MUST be verified by the Information Security Department?

The service provider's policies can meet the requirements imposed by the new environment even if they differ from the organization's current policies.

The service provider's policies are consistent with ISO/IEC27001 and there is evidence that the service provider is following those policies.

The service provider will segregate the data within its systems and ensure that each region's policies are met.

The service provider will impose controls and protections that meet or exceed the current systems controls and produce audit logs as verification.

The service provider's policies can meet the requirements imposed by the new environment even if they differ from the organization's current policies.

Which of the following is an appropriate source for test data?

Production data that has been sanitized before loading into a test environment.

Production data that is secured and maintained only in the production environment.

Test data that has no similarities to production datA.

Test data that is mirrored and kept up-to-date with production datA.

Production data that has been sanitized before loading into a test environment.

What is the FIRST step in developing a security test and its evaluation?

Identify all applicable security requirements

Identify people, processes, and products not in compliance

How can a forensic specialist exclude from examination a large percentage of operating system files residing on a copy of the target system?

Create a comparison database of cryptographic hashes of the files from a system with the same operating system and patch level.

Take another backup of the media in question then delete all irrelevant operating system files.

Create a comparison database of cryptographic hashes of the files from a system with the same operating system and patch level.

Generate a message digest (MD) or secure hash on the drive image to detect tampering of the media being examined.

Discard harmless files for the operating system, and known installed programs.

Which one of the following is a threat related to the use of web-based client side input validation?

Users would be able to alter the input after validation has occurred

The web server would not be able to validate the input after transmission

The client system could receive invalid input from the web server

The web server would not be able to receive invalid input from the client

Which of the following is a potential risk when a program runs in privileged mode?

It may allow malicious code to be inserted

It may serve to create unnecessary code complexity

It may not enforce job separation duties

It may create unnecessary application hardening

It may allow malicious code to be inserted

The goal of software assurance in application development is to

prevent the creation of vulnerable applications.

enable the development of High Availability (HA) systems.

facilitate the creation of Trusted Computing Base (TCB) systems.

prevent the creation of vulnerable applications.

encourage the development of open source applications.

What is the ultimate objective of information classification?

To ensure that information assets receive an appropriate level of protection

To assign responsibility for mitigating the risk to vulnerable systems

To ensure that information assets receive an appropriate level of protection

To recognize that the value of any item of information may change over time

To recognize the optimal number of classification categories and the benefits to be gained from their use

In a financial institution, who has the responsibility for assigning the classification to a piece of information?

Originator or nominated owner of the information

Chief Information Security Officer (CISO)

Originator or nominated owner of the information

Department head responsible for ensuring the protection of the information

An organization is designing a large enterprise-wide document repository system. They plan to have several different classification level areas with increasing levels of controls. The BEST way to ensure document confidentiality in the repository is to

encrypt the contents of the repository and document any exceptions to that requirement.

utilize Intrusion Detection System (IDS) set drop connections if too many requests for documents are detected.

keep individuals with access to high security areas from saving those documents into lower security areas.

require individuals with access to the system to sign Non-Disclosure Agreements (NDA).

Contingency plan exercises are intended to do which of the following?

Train personnel in roles and responsibilities

Validate service level agreements

Two companies wish to share electronic inventory and purchase orders in a supplier and client relationship. What is the BEST security solution for them?

Set up a Virtual Private Network (VPN) between the two companies.

Write a Service Level Agreement (SLA) for the two companies.

Set up a Virtual Private Network (VPN) between the two companies.

Configure a firewall at the perimeter of each of the two companies.

Establish a File Transfer Protocol (FTP) connection between the two companies.

Including a Trusted Platform Module (TPM) in the design of a computer system is an example of a technique to what?

Establish a secure initial state

Interface with the Public Key Infrastructure (PKI)

Improve the quality of security software

Prevent Denial of Service (DoS) attacks

Establish a secure initial state

What a patch management program?

Perform automatic deployment of patches.

Monitor for vulnerabilities and threats.

Prioritize vulnerability remediation.

Which of the following is an open standard for exchanging authentication and authorization data between parties?

Security Assertion Markup Language (SAML)

Hypertext Markup Language (HTML)

Extensible Markup Language (XML)

Security Assertion Markup Language (SAML)

ISC CISSP Practice Test 4 - Free Online Exam Prep & Questions

The key benefits of a signed and encrypted e-mail include

confidentiality, authentication, and authorization.

confidentiality, non-repudiation, and authentication.

non-repudiation, authorization, and authentication.

non-repudiation, confidentiality, and authorization.

Comment (0)

ISC CISSP Practice Test 4

Question

ISC CISSP Practice Tests

Practice Tests