The goal of a Business Continuity Plan (BCP) training and awareness program is to

enhance the skills required to create, maintain, and execute the plan.

provide for a high level of recovery in case of disaster.

describe the recovery organization to new employees.

provide each recovery team with checklists and procedures.

An organization has developed a major application that has undergone accreditation testing. After receiving the results of the evaluation, what is the final step before the application can be accredited?

Acceptance of risk by the authorizing official

Adoption of standardized policies and procedures

Approval of the System Security Plan (SSP)

What is one way to mitigate the risk of security flaws in custom software?

Include security assurance clauses in the Service Level Agreement (SLA)

Include security language in the Earned Value Management (EVM) contract

Include security assurance clauses in the Service Level Agreement (SLA)

Purchase only Commercial Off-The-Shelf (COTS) products

Purchase only software with no open source Application Programming Interfaces (APIs)

Which of the following is the BEST example of weak management commitment to the protection of security assets and resources?

poor governance over security processes and procedures

immature security controls and procedures

variances against regulatory requirements

unanticipated increases in security incidents and threats

What does an organization FIRST review to assure compliance with privacy requirements?

Employee's compliance to policies and standards

Which security approach will BEST minimize Personally Identifiable Information (PII) loss from a data breach?

Limited collection of individuals' confidential data

A strong breach notification process

Limited collection of individuals' confidential data

End-to-end data encryption for data in transit

Continuous monitoring of potential vulnerabilities

Which of the following methods can be used to achieve confidentiality and integrity for data in transit?

Internet Protocol Security (IPSec)

Multiprotocol Label Switching (MPLS)

Internet Protocol Security (IPSec)

Which of the following are Systems Engineering Life Cycle (SELC) Technical Processes?

Stakeholder Requirements Definition, Architectural Design, Implementation, Verification, Operation

Concept, Development, Production, Utilization, Support, Retirement

Stakeholder Requirements Definition, Architectural Design, Implementation, Verification, Operation

Acquisition, Measurement, Configuration Management, Production, Operation, Support

Concept, Requirements, Design, Implementation, Production, Maintenance, Support, Disposal

Which of the following BEST describes a Protection Profile (PP)?

A document that expresses an implementation independent set of security requirements for an IT product that meets specific consumer needs.

A document that is used to develop an IT security product from its security requirements definition.

A document that expresses an implementation dependent set of security requirements which contains only the security functional requirements.

A document that represents evaluated products where there is a one-to-one correspondence between a PP and a Security Target (ST).

Which of the following BEST describes a rogue Access Point (AP)?

An AP connected to the wired infrastructure but not under the management of authorized network administrators

An AP that is not protected by a firewall

An AP not configured to use Wired Equivalent Privacy (WEP) with Triple Data Encryption Algorithm (3DES)

An AP connected to the wired infrastructure but not under the management of authorized network administrators

An AP infected by any kind of Trojan or Malware

The 802.1x standard provides a framework for what?

Network authentication for wired and wireless networks

Network authentication for only wireless networks

Network authentication for wired and wireless networks

Wireless encryption using the Advanced Encryption Standard (AES)

Wireless network encryption using Secure Sockets Layer (SSL)

Single Sign-On (SSO) is PRIMARILY designed to address which of the following?

Availability and Accountability

Which of the following is the PRIMARY security concern associated with the implementation of smart cards?

Vendor application compatibility

Mobile code can be embedded in the card

What is an important characteristic of Role Based Access Control (RBAC)?

Simplifies the management of access rights

Supports Mandatory Access Control (MAC)

Simplifies the management of access rights

Requires two factor authentication

Which of the following is an essential step before performing Structured Query Language (SQL) penetration tests on a production system?

Validate target systems have been backed up.

Verify countermeasures have been deactivated.

Ensure firewall logging has been activated.

Validate target systems have been backed up.

Confirm warm site is ready to accept connections.

What is the GREATEST challenge of an agent-based patch management solution?

Requires that software be installed, running, and managed on all participating computers

Time to gather vulnerability information about the computers in the program

Requires that software be installed, running, and managed on all participating computers

The significant amount of network bandwidth while scanning computers

The consistency of distributing patches to each participating computer

Disaster Recovery Plan (DRP) training material should be

consistent so that all audiences receive the same training.

stored in a fire proof safe to ensure availability when needed.

only delivered in paper format.

presented in a professional looking manner.

The MAIN reason an organization conducts a security authorization process is to

force the organization to make conscious risk decisions.

assure the effectiveness of security controls.

assure the correct security organization exists.

force the organization to enlist management support.

During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant.What is the best approach for the CISO?During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant.What is the best approach for the CISO?

Perform a vulnerability assessment

Document the system as high risk

Perform a vulnerability assessment

Perform a quantitative threat assessment

Notate the information and move on

The World Trade Organization's (WTO) agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS) requires authors of computer software to be given the

right to refuse or permit commercial rentals.

right to disguise the software's geographic origin.

ability to tailor security parameters based on location.

ability to confirm license authenticity of their works.

What is the GREATEST challenge to identifying data leaks?

Documented asset classification policy and clear labeling of assets.

Available technical tools that enable user activity monitoring.

Documented asset classification policy and clear labeling of assets.

Senior management cooperation in investigating suspicious behavior.

Law enforcement participation to apprehend and interrogate suspects.

Who is ultimately responsible to ensure that information assets are categorized and adequate measures are taken to protect them?

Chief Information Security Officer

Data/Information/Business Owners

Which of the following is the PRIMARY benefit of implementing data-in-use controls?

When the data is being viewed, it can only be printed by authorized users.

If the data is lost, it must be decrypted to be opened.

If the data is lost, it will not be accessible to unauthorized users.

When the data is being viewed, it can only be printed by authorized users.

When the data is being viewed, it must be accessed using secure protocols.

A health care provider is considering Internet access for their employees and patients. Which of the following is the organization's MOST secure solution for protection of data?

Public Key Infrastructure (PKI) and digital signatures

Trusted server certificates and passphrases

Asymmetric encryption and User ID

Which of the following BEST describes the purpose of the security functional requirements of Common Criteria?

Security behavior expected of a TOE

Level of assurance of the Target of Evaluation (TOE) in intended operational environment

Selection to meet the security objectives stated in test documents

Security behavior expected of a TOE

Definition of the roles and responsibilities

The PRIMARY security concern for handheld devices is the

ability to bypass the authentication mechanism.

strength of the encryption algorithm.

spread of malware during synchronization.

ability to bypass the authentication mechanism.

strength of the Personal Identification Number (PIN).

Which of the following is the BIGGEST weakness when using native Lightweight Directory Access Protocol (LDAP) for authentication?

Passwords are passed in cleartext

Authorizations are not included in the server response

Unsalted hashes are passed over the network

The authentication session can be replayed

Passwords are passed in cleartext

A global organization wants to implement hardware tokens as part of a multifactor authentication solution for remote access. The PRIMARY advantage of this implementation is

it protects against unauthorized access.

the scalability of token enrollment.

increased accountability of end users.

it protects against unauthorized access.

it simplifies user access administration.

ISC CISSP Practice Test 9 - Free Online Exam Prep & Questions

How does an organization verify that an information system's current hardware and software match the standard system configuration?

By reviewing the configuration after the system goes into production

By running vulnerability scanning tools on all devices in the environment

By comparing the actual configuration of the system against the baseline

By verifying all the approved security patches are implemented

Comment (0)

ISC CISSP Practice Test 9

Question

ISC CISSP Practice Tests

Practice Tests