Home / ISC / CISSP

ISC CISSP Practice Test - Questions Answers, Page 102

Question list

List of questions

Question 1011

(0)

Which of the following encryption technologies has the ability to function as a stream cipher?

Question 1012

(0)

An attack utilizing social engineering and a malicious Uniform Resource Locator (URL) link to take advantage of a victim's existing browser session with a web application is an example of which of t

Question 1013

(0)

Which of the following is the BEST method to identify security controls that should be implemented for a web-based application while in development?

Question 1014

(0)

A security professional has reviewed a recent site assessment and has noted that a server room on the second floor of a building has Heating, Ventilation, and Air Conditioning (HVAC) intakes on the

Question 1015

(0)

An organization is setting a security assessment scope with the goal of developing a Security Management Program (SMP). The next step is to select an approach for conducting the risk assessment. Whi

Question 1016

(0)

Which combination of cryptographic algorithms are compliant with Federal Information Processing Standard (FIPS) Publication 140-2 for non-legacy systems?

Question 1017

(0)

An international trading organization that holds an International Organization for Standardization (ISO) 27001 certification is seeking to outsource their security monitoring to a managed security s

Question 1018

(0)

Which of the following is the MOST effective measure for dealing with rootkit attacks?

Question 1019

(0)

While classifying credit card data related to Payment Card Industry Data Security Standards (PCI-DSS), which of the following is a PRIMARY security requirement?

Question 1020

(0)

Write Once, Read Many (WORM) data storage devices are designed to BEST support which of the following core security concepts?

Question 1011

Which of the following encryption technologies has the ability to function as a stream cipher?

Cipher Feedback (CFB)

Feistel cipher

Cipher Block Chaining (CBC) with error propagation

Electronic Code Book (ECB)

Show Answer Comment (0)

An attack utilizing social engineering and a malicious Uniform Resource Locator (URL) link to take advantage of a victim's existing browser session with a web application is an example of which of the following types of attack?

Cross-Site Scripting (XSS)

Cross-site request forgery (CSRF)

Injection

Click jacking

Show Answer Comment (0)

Question 1013

Which of the following is the BEST method to identify security controls that should be implemented for a web-based application while in development?

Application threat modeling

Secure software development.

Agile software development

Penetration testing

Show Answer Comment (0)

Question 1014

A security professional has reviewed a recent site assessment and has noted that a server room on the second floor of a building has Heating, Ventilation, and Air Conditioning (HVAC) intakes on the ground level that have ultraviolet light filters installed, Aero-K Fire suppression in the server room, and pre-action fire suppression on floors above the server room. Which of the following changes can the security professional recommend to reduce risk associated with these conditions?

Remove the ultraviolet light filters on the HVAC intake and replace the fire suppression system on the upper floors with a dry system

Add additional ultraviolet light filters to the HVAC intake supply and return ducts and change server room fire suppression to FM-200

Apply additional physical security around the HVAC intakes and update upper floor fire suppression to FM-200.

Elevate the HVAC intake by constructing a plenum or external shaft over it and convert the server room fire suppression to a pre-action system

Show Answer Comment (0)

Question 1015

An organization is setting a security assessment scope with the goal of developing a Security Management Program (SMP). The next step is to select an approach for conducting the risk assessment. Which of the following approaches is

MOST effective for the SMP?

Data driven risk assessment with a focus on data

Security controls driven assessment that focuses on controls management

Business processes based risk assessment with a focus on business goals

Asset driven risk assessment with a focus on the assets

Show Answer Comment (0)

Question 1016

Which combination of cryptographic algorithms are compliant with Federal Information Processing Standard (FIPS) Publication 140-2 for non-legacy systems?

Diffie-hellman (DH) key exchange: DH (>=2048 bits)Symmetric Key: Advanced Encryption Standard (AES) > 128 bitsDigital Signature: Rivest-Shamir-Adleman (RSA) (1024 bits)

Diffie-hellman (DH) key exchange: DH (>=2048 bits)Symmetric Key: Advanced Encryption Standard (AES) > 128 bitsDigital Signature: Digital Signature Algorithm (DSA) (>=2048 bits)

Diffie-hellman (DH) key exchange: DH (<= 1024 bits)Symmetric Key: BlowfishDigital Signature: Rivest-Shamir-Adleman (RSA) (>=2048 bits)

Diffie-hellman (DH) key exchange: DH (>=2048 bits)Symmetric Key: Advanced Encryption Standard (AES) < 128 bitsDigital Signature: Elliptic Curve Digital Signature Algorithm (ECDSA) (>=256 bits)

Show Answer Comment (0)

Question 1017

An international trading organization that holds an International Organization for Standardization (ISO) 27001 certification is seeking to outsource their security monitoring to a managed security service provider (MSSP), The trading organization's security officer is tasked with drafting the requirements that need to be included in the outsourcing contract.

Which of the following MUST be included in the contract?

A detailed overview of all equipment involved in the outsourcing contract

The MSSP having an executive manager responsible for information security

The right to perform security compliance tests on the MSSP's equipment

The right to audit the MSSP's security process

Show Answer Comment (0)

Question 1018

Which of the following is the MOST effective measure for dealing with rootkit attacks?

Turing off unauthorized services and rebooting the system

Finding and replacing the altered binaries with legitimate ones

Restoring the system from the last backup

Reinstalling the system from trusted sources

Show Answer Comment (0)

Question 1019

While classifying credit card data related to Payment Card Industry Data Security Standards (PCI-DSS), which of the following is a PRIMARY security requirement?

Processor agreements with card holders

Three-year retention of data

Encryption of data

Specific card disposal methodology

Show Answer Comment (0)