Home / ISC / CISSP

ISC CISSP Practice Test - Questions Answers, Page 115

Question list

List of questions

Question 1141

(0)

An attacker has intruded into the source code management system and is able to download but not modify the code. Which of the following aspects of the code theft has the HIGHEST security impact?

Question 1142

(0)

Which of the following statements BEST describes least privilege principle in a cloud environment?

Question 1143

(0)

Which is the BEST control to meet the Statement on Standards for Attestation Engagements 18 (SSAE-18) confidentiality category?

Question 1144

(0)

The initial security categorization should be done early in the system life cycle and should be reviewed periodically. Why is it important for this to be done correctly?

Question 1145

(0)

Which of the following vulnerabilities can be BEST detected using automated analysis?

Question 1146

(0)

An organization wants to migrate to Session Initiation Protocol (SIP) to save on telephony expenses. Which of the following security related statements should be considered in the decision-making p

Question 1147

(0)

An organization's retail website provides its only source of revenue, so the disaster recovery plan (DRP) must document an estimated time for each step in the plan. Which of the following steps in

Question 1148

(0)

Why is it important that senior management clearly communicates the formal Maximum Tolerable Downtime (MTD) decision?

Question 1149

(0)

Which of the following activities should a forensic examiner perform FIRST when determining the priority of digital evidence collection at a crime scene?

Question 1150

(0)

When assessing web vulnerabilities, how can navigating the dark web add value to a penetration test?

Question 1141

An attacker has intruded into the source code management system and is able to download but not modify the code. Which of the following aspects of the code theft has the HIGHEST security impact?

The attacker could publicly share confidential comments found in the stolen code.

Competitors might be able to steal the organization's ideas by looking at the stolen code.

A competitor could run their own copy of the organization's website using the stolen code.

Administrative credentials or keys hard-coded within the stolen code could be used to access sensitive data.

Show Answer Comment (0)

Question 1142

Which of the following statements BEST describes least privilege principle in a cloud environment?

Network segments remain private if unneeded to access the internet.

Internet traffic is inspected for all incoming and outgoing packets.

A single cloud administrator is configured to access core functions.

Routing configurations are regularly updated with the latest routes.

Show Answer Comment (0)

Question 1143

Which is the BEST control to meet the Statement on Standards for Attestation Engagements 18 (SSAE-18) confidentiality category?

Data processing

Storage encryption

File hashing

Data retention policy

Show Answer Comment (0)

Question 1144

The initial security categorization should be done early in the system life cycle and should be reviewed periodically. Why is it important for this to be done correctly?

It determines the security requirements.

It affects other steps in the certification and accreditation process.

It determines the functional and operational requirements.

The system engineering process works with selected security controls.

Show Answer Comment (0)

Question 1145

Which of the following vulnerabilities can be BEST detected using automated analysis?

Valid cross-site request forgery (CSRF) vulnerabilities

Multi-step process attack vulnerabilities

Business logic flaw vulnerabilities

Typical source code vulnerabilities

Show Answer Comment (0)

Question 1146

An organization wants to migrate to Session Initiation Protocol (SIP) to save on telephony expenses.

Which of the following security related statements should be considered in the decision-making process?

Cloud telephony is less secure and more expensive than digital telephony services.

SIP services are more secure when used with multi-layer security proxies.

H.323 media gateways must be used to ensure end-to-end security tunnels.

Given the behavior of SIP traffic, additional security controls would be required.

Show Answer Comment (0)

Question 1147

An organization's retail website provides its only source of revenue, so the disaster recovery plan (DRP) must document an estimated time for each step in the plan.

Which of the following steps in the DRP will list the GREATEST duration of time for the service to be fully operational?

Update the Network Address Translation (NAT) table.

Update Domain Name System (DNS) server addresses with domain registrar.

Update the Border Gateway Protocol (BGP) autonomous system number.

Update the web server network adapter configuration.

Show Answer Comment (0)

Question 1148

Why is it important that senior management clearly communicates the formal Maximum Tolerable Downtime (MTD) decision?

To provide each manager with precise direction on selecting an appropriate recovery alternative

To demonstrate to the regulatory bodies that the company takes business continuity seriously

To demonstrate to the board of directors that senior management is committed to continuity recovery efforts

To provide a formal declaration from senior management as required by internal audit to demonstrate sound business practices

Show Answer Comment (0)

Question 1149

Which of the following activities should a forensic examiner perform FIRST when determining the priority of digital evidence collection at a crime scene?

Gather physical evidence,

Establish order of volatility.

Assign responsibilities to personnel on the scene.

Establish a list of files to examine.

Show Answer Comment (0)