What is the MOST critical factor to achieve the goals of a security program?

Capabilities of security resources

Effectiveness of security management

Budget approved for security resources

A business has implemented Payment Card Industry Data Security Standard (PCI-DSS) compliant handheld credit card processing on their Wireless Local Area Network (WLAN) topology. The network team partitioned the WLAN to create a private segment for credit card processing using a firewall to control device access and route traffic to the card processor on the Internet. What components are in the scope of PCI-DSS?

The end devices, wireless access points, WLAN, switches, management console, and firewall.

The entire enterprise network infrastructure.

The handheld devices, wireless access points and border gateway.

The end devices, wireless access points, WLAN, switches, management console, and firewall.

The end devices, wireless access points, WLAN, switches, management console, and Internet

During an audit, the auditor finds evidence of potentially illegal activity. Which of the following is the MOST appropriate action to take?

Work with the client to report the activity to the appropriate authority

Work with the client to resolve the issue internally

Advise the person performing the illegal activity to cease and desist

Work with the client to report the activity to the appropriate authority

What is the BEST first step for determining if the appropriate security controls are in place for protecting data at rest?

Identify regulatory requirements

Review the security baseline configuration

Which of the following provides the MOST protection against data theft of sensitive information when a laptop is stolen?

Encrypt the entire disk and delete contents after a set number of failed access attempts

Set up a BIOS and operating system password

Encrypt the virtual drive where confidential files can be stored

Implement a mandatory policy in which sensitive data cannot be stored on laptops, but only on the corporate network

Encrypt the entire disk and delete contents after a set number of failed access attempts

Which of the following is a MAJOR consideration in implementing a Voice over IP (VoIP) network?

Use of separation for the voice network.

Use of Network Access Control (NAC) on switches.

Use of Request for Comments (RFC) 1918 addressing.

Host-Based Intrusion Protection (HIPS) systems are often deployed in monitoring or learning mode during their initial implementation. What is the objective of starting in this mode?

Build a baseline of normal or safe system events for review

Automatically create exceptions for specific actions or files

Determine which files are unsafe to access and blacklist them

Automatically whitelist actions or files known to the system

Build a baseline of normal or safe system events for review

Which of the following describes the concept of a Single Sign -On (SSO) system?

Users are authenticated to multiple systems with one login.

Users are authenticated to one system at a time.

Users are identified to multiple systems with several credentials.

Users are authenticated to multiple systems with one login.

Only one user is using the system at a time.

What physical characteristic does a retinal scan biometric device measure?

The pattern of blood vessels at the back of the eye

The amount of light reflected by the retina

The size, curvature, and shape of the retina

The pattern of blood vessels at the back of the eye

The pattern of light receptors at the back of the eye

Which of the following provides the minimum set of privileges required to perform a job function and restricts the user to a domain with the required privileges?

Access determined by the system

Access based on data sensitivity

Discretionary Access Control (DAC) restricts access according to

authorizations granted to the user.

page views within an application.

authorizations granted to the user.

Retaining system logs for six months or longer can be valuable for what activities?

Forensics and incident response

Disaster recovery and business continuity

Forensics and incident response

Identity and authorization management

Physical and logical access control

Which of the following statements is TRUE regarding value boundary analysis as a functional software testing technique?

Test inputs are obtained from the derived threshold of the given functional specifications.

It is useful for testing communications protocols and graphical user interfaces.

It is characterized by the stateless behavior of a process implemented in a function.

Test inputs are obtained from the derived threshold of the given functional specifications.

An entire partition can be covered by considering only one representative value from that partition.

Data leakage of sensitive information is MOST often concealed by which of the following?

Secure Post Office Protocol (POP)

Which of the following is a reason to use manual patch installation instead of automated patch management?

The likelihood of system or application incompatibilities will be decreased.

The cost required to install patches will be reduced.

The time during which systems will remain vulnerable to an exploit will be decreased.

The likelihood of system or application incompatibilities will be decreased.

The ability to cover large geographic areas is increased.

The PRIMARY outcome of a certification process is that it provides documented

security analyses needed to make a risk-based decision.

system weaknesses for remediation.

standards for security assessment, testing, and process evaluation.

interconnected systems and their implemented security controls.

security analyses needed to make a risk-based decision.

Which of the following standards/guidelines requires an Information Security Management System (ISMS) to be defined?

International Organization for Standardization (ISO) 27000 family

Information Technology Infrastructure Library (ITIL)

Payment Card Industry Data Security Standard (PCIDSS)

Which of the following PRIMARILY contributes to security incidents in web-based applications?

Third-party applications and change controls

Systems administration and operating systems

System incompatibility and patch management

Third-party applications and change controls

Improper stress testing and application interfaces

Data remanence refers to which of the following?

The residual information left on magnetic storage media after a deletion or erasure.

The remaining photons left in a fiber optic cable after a secure transmission.

The retention period required by law or regulation.

The magnetic flux created when removing the network connection from a server or personal computer.

The residual information left on magnetic storage media after a deletion or erasure.

Which of the following describes the BEST configuration management practice?

A baseline configuration is created and maintained for all relevant systems.

After installing a new system, the configuration files are copied to a separate back-up system and hashed to detect tampering.

After installing a new system, the configuration files are copied to an air-gapped system and hashed to detect tampering.

The firewall rules are backed up to an air-gapped system.

A baseline configuration is created and maintained for all relevant systems.

How does Encapsulating Security Payload (ESP) in transport mode affect the Internet Protocol (IP)?

Encrypts and optionally authenticates the IP payload, but not the IP header

Encrypts and optionally authenticates the IP header, but not the IP payload

Encrypts and optionally authenticates the IP payload, but not the IP header

Authenticates the IP payload and selected portions of the IP header

Encrypts and optionally authenticates the complete IP packet

Which of the following is the MOST likely cause of a non-malicious data breach when the source of the data breach was an un-marked file cabinet containing sensitive documents?

Ineffective data classification

Ineffective identity management controls

Lack of Data Loss Prevention (DLP) tools

A security professional has been asked to evaluate the options for the location of a new data center within a multifloor building. Concerns for the data center include emanations and physical access controls.Which of the following is the BEST location?

In an exterior room with windows

Which of the following is the PRIMARY concern when using an Internet browser to access a cloudbased service?

Vulnerabilities within protocols that can expose confidential data

Insecure implementation of Application Programming Interfaces (API)

Improper use and storage of management keys

Misconfiguration of infrastructure allowing for unauthorized access

Vulnerabilities within protocols that can expose confidential data

After a thorough analysis, it was discovered that a perpetrator compromised a network by gaining access to the network through a Secure Socket Layer (SSL) Virtual Private Network (VPN) gateway.The perpetrator guessed a username and brute forced the password to gain access. Which of the following BEST mitigates this issue?

Use two-factor authentication mechanisms

Implement strong passwords authentication for VPN

Integrate the VPN with centralized credential stores

Implement an Internet Protocol Security (IPSec) client

Use two-factor authentication mechanisms

For an organization considering two-factor authentication for secure network access, which of the following is MOST secure?

Challenge response and private key

Digital certificates and Single Sign-On (SSO)

Regarding asset security and appropriate retention, which of the following INITIAL top three areas are important to focus on?

Security control baselines, access controls, employee awareness and training

Human resources, asset management, production management

Supply chain lead time, inventory control, encryption

Polygraphs, crime statistics, forensics

Discretionary Access Control (DAC) is based on which of the following?

Identification of subjects and objects

Information source and destination

Identification of subjects and objects

ISC CISSP Practice Test 8 - Free Online Exam Prep & Questions

Question 1 / 40

Refer to the information below to answer the question.

A large, multinational organization has decided to outsource a portion of their Information Technology (IT) organization to a third-party provider's facility. This provider will be responsible for the design, development, testing, and support of several critical, customer-based applications used by the organization.

The third party needs to have

processes that are identical to that of the organization doing the outsourcing.

access to the original personnel that were on staff at the organization.

the ability to maintain all of the applications in languages they are familiar with.

access to the skill sets consistent with the programming languages used by the organization.

Comment (0)

ISC CISSP Practice Test 8

Question

ISC CISSP Practice Tests

Practice Tests