Which of the following BEST describes Recovery Time Objective (RTO)?

Time of application resumption after disaster

Time of data validation after disaster

Time of data restoration from backup after disaster

Time of application resumption after disaster

Time of application verification after disaster

An online retail company has formulated a record retention schedule for customer transactions.Which of the following is a valid reason a customer transaction is kept beyond the retention schedule?

Customer makes request to retain

Useful for future business initiatives

Which of the following is the MAIN goal of a data retention policy?

Ensure the integrity and availability of data for a predetermined amount of time.

Ensure that data is destroyed properly.

Ensure that data recovery can be done on the datA.

Ensure the integrity and availability of data for a predetermined amount of time.

Ensure the integrity and confidentiality of data for a predetermined amount of time.

Which of the following problems is not addressed by using OAuth (Open Standard to Authorization) 2.0 to integrate a third-party identity provider for a service?

Resource Servers are required to use passwords to authenticate end users.

Revocation of access of some users of the third party instead of all the users from the third party.

Compromise of the third party means compromise of all the users in the service.

Guest users need to authenticate with the third party identity provider.

Multi-Factor Authentication (MFA) is necessary in many systems given common types of password attacks. Which of the following is a correct list of password attacks?

Brute force, dictionary, phishing, keylogger

Masquerading, salami, malware, polymorphism

Brute force, dictionary, phishing, keylogger

Which of the following is an example of two-factor authentication?

Magnetic stripe card and an ID badge

Password and Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA)

Which item below is a federated identity standard?

Security Assertion Markup Language (SAML)

Lightweight Directory Access Protocol (LDAP)

Security Assertion Markup Language (SAML)

What is a common challenge when implementing Security Assertion Markup Language (SAML) for identity integration between on-premise environment and an external identity provider service?

Some users are not provisioned into the service.

SAML tokens are provided by the on-premise identity provider.

Single users cannot be revoked from the service.

SAML tokens contain user information.

Refer to the information below to answer the question.A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive email, search the web, and use instant messaging. The organization's Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access.Which of the following could have MOST likely prevented the Peer-to-Peer (P2P) program from being installed on the computer?

Removing employee's full access to the computer

Supervising their child's use of the computer

Limiting computer's access to only the employee

Ensuring employee understands their business conduct guidelines

Refer to the information below to answer the question.A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive email, search the web, and use instant messaging. The organization's Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access.Which of the following solutions would have MOST likely detected the use of peer-to-peer programs when the computer was connected to the office network?

Intrusion Prevention System (IPS)

Refer to the information below to answer the question.A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive email, search the web, and use instant messaging. The organization's Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access.Which of the following methods is the MOST effective way of removing the Peer-to-Peer (P2P) program from the computer?

Find and remove all installation files

Delete all cookies stored in the web browser cache

Refer to the information below to answer the question.A security practitioner detects client-based attacks on the organization's network. A plan will be necessary to address these concerns.In the plan, what is the BEST approach to mitigate future internal client-based attacks?

Harden the client image before deployment.

Block all client side web exploits at the perimeter.

Remove all non-essential client-side web services from the network.

Screen for harmful exploits of client-side services before implementation.

Harden the client image before deployment.

Refer to the information below to answer the question.A security practitioner detects client-based attacks on the organization's network. A plan will be necessary to address these concerns.In addition to web browsers, what PRIMARY areas need to be addressed concerning mobile code used for malicious purposes?

Email, media players, and instant messaging applications

Text editors, database, and Internet phone applications

Email, presentation, and database applications

Image libraries, presentation and spreadsheet applications

Email, media players, and instant messaging applications

Refer to the information below to answer the question.A security practitioner detects client-based attacks on the organization's network. A plan will be necessary to address these concerns.What is the BEST reason for the organization to pursue a plan to mitigate client-based attacks?

Client-based attacks are more common and easier to exploit than server and network based attacks.

Client privilege administration is inherently weaker than server privilege administration.

Client hardening and management is easier on clients than on servers.

Client-based attacks are more common and easier to exploit than server and network based attacks.

Client-based attacks have higher financial impact.

Refer to the information below to answer the question.A large organization uses unique identifiers and requires them at the start of every system session.Application access is based on job classification. The organization is subject to periodic independent reviews of access controls and violations. The organization uses wired and wireless networks and remote access. The organization also uses secure connections to branch offices and secure backup and recovery strategies for selected information and processes.Which of the following BEST describes the access control methodology used?

Role Based Access Control (RBAC)

Lattice Based Access Control (LBAC)

Role Based Access Control (RBAC)

Lightweight Directory Access Control (LDAP)

Refer to the information below to answer the question.An organization has hired an information security officer to lead their security department. The officer has adequate people resources but is lacking the other necessary components to have an effective security program. There are numerous initiatives requiring security involvement.Which of the following is considered the MOST important priority for the information security officer?

Formal acceptance of the security strategy

Disciplinary actions taken against unethical behavior

Development of an awareness program for new employees

Audit of all organization system configurations for faults

Refer to the information below to answer the question.An organization has hired an information security officer to lead their security department. The officer has adequate people resources but is lacking the other necessary components to have an effective security program. There are numerous initiatives requiring security involvement.The security program can be considered effective when

risk is lowered to an acceptable level.

vulnerabilities are proactively identified.

audits are regularly performed and reviewed.

backups are regularly performed and validated.

risk is lowered to an acceptable level.

Refer to the information below to answer the question.During the investigation of a security incident, it is determined that an unauthorized individual accessed a system which hosts a database containing financial information.Aside from the potential records which may have been viewed, which of the following should be the PRIMARY concern regarding the database information?

Confidentiality of the incident

Refer to the information below to answer the question.An organization experiencing a negative financial impact is forced to reduce budgets and the number of Information Technology (IT) operations staff performing basic logical access security administration functions. Security processes have been tightly integrated into normal IT operations and are not separate and distinct roles.Which of the following will be the PRIMARY security concern as staff is released from the organization?

Loss of data and separation of duties

Additional responsibilities for remaining staff

Refer to the information below to answer the question.An organization experiencing a negative financial impact is forced to reduce budgets and the number of Information Technology (IT) operations staff performing basic logical access security administration functions. Security processes have been tightly integrated into normal IT operations and are not separate and distinct roles.Which of the following will MOST likely allow the organization to keep risk at an acceptable level?

Assigning privileged functions to appropriate staff

Increasing the amount of audits performed by third parties

Removing privileged accounts from operational staff

Assigning privileged functions to appropriate staff

Separating the security function into distinct roles

Refer to the information below to answer the question.Desktop computers in an organization were sanitized for re-use in an equivalent security environment. The data was destroyed in accordance with organizational policy and all marking and other external indications of the sensitivity of the data that was formerly stored on the magnetic drives were removed.After magnetic drives were degaussed twice according to the product manufacturer's directions, what is the MOST LIKELY security issue with degaussing?

Degausser products may not be properly maintained and operated.

Commercial products often have serious weaknesses of the magnetic force available in the degausser product.

Degausser products may not be properly maintained and operated.

The inability to turn the drive around in the chamber for the second pass due to human error.

Inadequate record keeping when sanitizing mediA.

ISC CISSP Practice Test 7 - Free Online Exam Prep & Questions

Without proper signal protection, embedded systems may be prone to which type of attack?

Brute force

Tampering

Information disclosure

Denial of Service (DoS)

Comment (0)

ISC CISSP Practice Test 7

Question

ISC CISSP Practice Tests

Practice Tests