Which of the following is a critical factor for implementing a successful data classification program?

Information security sponsorship

An organization's data policy MUST include a data retention period which is based on

digital certificates expiration.

What is the MOST important reason to configure unique user IDs?

Supporting Single Sign On (SSO)

What is the PRIMARY advantage of using automated application security testing tools?

Large amounts of code can be tested using fewer resources.

The application can be protected in the production environment.

Large amounts of code can be tested using fewer resources.

The application will fail less when tested using these tools.

Detailed testing of code functions can be performed.

When using third-party software developers, which of the following is the MOST effective method of providing software development Quality Assurance (QA)?

Perform overlapping code reviews by both parties.

Retain intellectual property rights through contractual wording.

Perform overlapping code reviews by both parties.

Verify that the contractors attend development planning meetings.

Create a separate contractor development environment.

What do Capability Maturity Models (CMM) serve as a benchmark for in an organization?

Procedures in systems development

Definition of security profiles

Human resource planning efforts

Procedures in systems development

Which of the following is the MOST crucial for a successful audit plan?

Defining the scope of the audit to be performed

Identifying the security controls to be implemented

Working with the system owner on new controls

Acquiring evidence of systems that are not compliant

An organization decides to implement a partial Public Key Infrastructure (PKI) with only the servers having digital certificates. What is the security benefit of this implementation?

Servers can authenticate themselves to the client.

Clients can authenticate themselves to the servers.

Mutual authentication is available between the clients and servers.

Servers are able to issue digital certificates to the client.

Servers can authenticate themselves to the client.

Which of the following is the PRIMARY benefit of a formalized information classification program?

It reduces asset vulnerabilities.

It minimizes system logging requirements.

If an attacker in a SYN flood attack uses someone else's valid host address as the source address, the system under attack will send a large number of Synchronize/Acknowledge (SYN/ACK) packets to the

local interface being attacked.

According to best practice, which of the following is required when implementing third party software in a production environment?

Scan the application for vulnerabilities

Contract the vendor for patching

Negotiate end user application training

Which of the following is the BEST solution to provide redundancy for telecommunications links?

Provide multiple links from multiple telecommunications vendors.

Provide multiple links from the same telecommunications vendor.

Ensure that the telecommunications links connect to the network in one location.

Ensure that the telecommunications links connect to the network in multiple locations.

Provide multiple links from multiple telecommunications vendors.

Which of the following are required components for implementing software configuration management systems?

Rollback and recovery processes

Regression testing and evaluation

Which of the following BEST mitigates a replay attack against a system using identity federation and Security Assertion Markup Language (SAML) implementation?

Timed sessions and Secure Socket Layer (SSL)

Digital certificates and hardware tokens

Timed sessions and Secure Socket Layer (SSL)

Passwords with alpha-numeric and special characters

What is the BEST method to detect the most common improper initialization problems in programming languages?

Use automated static analysis tools that target this type of weakness.

Use and specify a strong character encoding.

Use automated static analysis tools that target this type of weakness.

Perform input validation on any numeric inputs by assuring that they are within the expected range.

Use data flow analysis to minimize the number of false positives.

During the procurement of a new information system, it was determined that some of the security requirements were not addressed in the system specification. Which of the following is the MOST likely reason for this?

The description of the security requirements was insufficient.

The procurement officer lacks technical knowledge.

The security requirements have changed during the procurement process.

There were no security professionals in the vendor's bidding team.

The description of the security requirements was insufficient.

Which of the following is required to determine classification and ownership?

System and data resources are properly identified

Access violations are logged and audited

Data file references are identified and linked

System security controls are fully integrated

A large university needs to enable student access to university resources from their homes. Which of the following provides the BEST option for low maintenance and ease of deployment?

Use Secure Sockets Layer (SSL) VPN technology.

Provide students with Internet Protocol Security (IPSec) Virtual Private Network (VPN) client software.

Use Secure Sockets Layer (SSL) VPN technology.

Use Secure Shell (SSH) with public/private keys.

Require students to purchase home router capable of VPN.

A risk assessment report recommends upgrading all perimeter firewalls to mitigate a particular finding. Which of the following BEST supports this recommendation?

The expected loss from the risk exceeds mitigation costs.

The inherent risk is greater than the residual risk.

The Annualized Loss Expectancy (ALE) approaches zero.

The expected loss from the risk exceeds mitigation costs.

The infrastructure budget can easily cover the upgrade costs.

A system is developed so that its business users can perform business functions but not user administration functions. Application administrators can perform administration functions but not user business functions. These capabilities areBEST described as

Mandatory Access Control (MAC).

A security manager has noticed an inconsistent application of server security controls resulting in vulnerabilities on critical systems. What is the MOST likely cause of this issue?

Improper documentation of security guidelines

A poorly designed security policy communication program

Host-based Intrusion Prevention System (HIPS) policies are ineffective

Which of the following is the BEST countermeasure to brute force login attacks?

Introducing a delay after failed system access attempts

Changing all canonical passwords

Decreasing the number of concurrent user sessions

Restricting initial password delivery only in person

Introducing a delay after failed system access attempts

A Business Continuity Plan (BCP) is based on

a standard checklist of required items and objectives.

the policy and procedures manual.

an existing BCP from a similar organization.

a review of the business processes and procedures.

a standard checklist of required items and objectives.

When implementing a secure wireless network, which of the following supports authentication and authorization for individual client endpoints?

Wi-Fi Protected Access 2 (WPA2) Enterprise

Temporal Key Integrity Protocol (TKIP)

Wi-Fi Protected Access (WPA) Pre-Shared Key (PSK)

Wi-Fi Protected Access 2 (WPA2) Enterprise

Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP)

Which of the following is the BEST way to determine if a particular system is able to identify malicious software without executing it?

Run multiple antivirus programs

Which of the following is a BEST practice when traveling internationally with laptops containing Personally Identifiable Information (PII)?

Do not take unnecessary information, including sensitive information.

Use a thumb drive to transfer information from a foreign computer.

Do not take unnecessary information, including sensitive information.

Connect the laptop only to well-known networks like the hotel or public Internet cafes.

Request international points of contact help scan the laptop on arrival to ensure it is protected.

When dealing with compliance with the Payment Card Industry-Data Security Standard (PCI-DSS), an organization that shares card holder information with a service provider MUST do which of the following?

Validate the service provider's PCI-DSS compliance status on a regular basis.

Perform a service provider PCI-DSS assessment on a yearly basis.

Validate the service provider's PCI-DSS compliance status on a regular basis.

Validate that the service providers security policies are in alignment with those of the organization.

Ensure that the service provider updates and tests its Disaster Recovery Plan (DRP) on a yearly basis.

Which of the following MUST system and database administrators be aware of and apply when configuring systems used for storing personal employee data?

The organization's security policies and standards

Secondary use of the data by business users

The organization's security policies and standards

The business purpose for which the data is to be used

The overall protection of corporate resources and data

Which of the following MOST influences the design of the organization's electronic monitoring policies?

Business ethical considerations

ISC CISSP Practice Test 6 - Free Online Exam Prep & Questions

With data labeling, which of the following MUST be the key decision maker?

Information security

Departmental management

Data custodian

Data owner

Comment (0)

ISC CISSP Practice Test 6

Question

ISC CISSP Practice Tests

Practice Tests