Home / ISC / CISSP

ISC CISSP Practice Test - Questions Answers, Page 19

Question list

List of questions

Question 181

(0)

Which of the following BEST represents the principle of open design?

Question 182

(0)

The BEST way to check for good security programming practices, as well as auditing for possible backdoors, is to conduct

Question 183

(0)

An auditor carrying out a compliance audit requests passwords that are encrypted in the system to verify that the passwords are compliant with policy. Which of the following is the BEST response to

Question 184

(0)

When building a data center, site location and construction factors that increase the level of vulnerability to physical threats include

Question 185

(0)

An organization allows ping traffic into and out of their network. An attacker has installed a program on the network that uses the payload portion of the ping packet to move data into and out of th

Question 186

(0)

Which of the following can BEST prevent security flaws occurring in outsourced software development?

Question 187

(0)

Which of the following is the MAIN reason that system re-certification and re-accreditation are needed?

Question 188

(0)

An external attacker has compromised an organization's network security perimeter and installed a sniffer onto an inside computer. Which of the following is the MOST effective layer of security the

Question 189

(0)

A security consultant has been asked to research an organization's legal obligations to protect privacy-related information. What kind of reading material is MOST relevant to this project?

Question 190

(0)

According to best practice, which of the following groups is the MOST effective in performing an information security compliance audit?

Question 181

Which of the following BEST represents the principle of open design?

Disassembly, analysis, or reverse engineering will reveal the security functionality of the computer system.

Algorithms must be protected to ensure the security and interoperability of the designed system.

A knowledgeable user should have limited privileges on the system to prevent their ability to compromise security capabilities.

The security of a mechanism should not depend on the secrecy of its design or implementation.

Show Answer Comment (0)

Question 182

The BEST way to check for good security programming practices, as well as auditing for possible backdoors, is to conduct

log auditing.

code reviews.

impact assessments.

static analysis.

Show Answer Comment (0)

An auditor carrying out a compliance audit requests passwords that are encrypted in the system to verify that the passwords are compliant with policy. Which of the following is the BEST response to the auditor?

Provide the encrypted passwords and analysis tools to the auditor for analysis.

Analyze the encrypted passwords for the auditor and show them the results.

Demonstrate that non-compliant passwords cannot be created in the system.

Demonstrate that non-compliant passwords cannot be encrypted in the system.

Show Answer Comment (0)

Question 184

When building a data center, site location and construction factors that increase the level of vulnerability to physical threats include

hardened building construction with consideration of seismic factors.

adequate distance from and lack of access to adjacent buildings.

curved roads approaching the data center.

proximity to high crime areas of the city.

Show Answer Comment (0)

Question 185

An organization allows ping traffic into and out of their network. An attacker has installed a program on the network that uses the payload portion of the ping packet to move data into and out of the network. What type of attack has the organization experienced?

Data leakage

Unfiltered channel

Data emanation

Covert channel

Show Answer Comment (0)

Question 186

Which of the following can BEST prevent security flaws occurring in outsourced software development?

Contractual requirements for code quality

Licensing, code ownership and intellectual property rights

Certification of the quality and accuracy of the work done

Delivery dates, change management control and budgetary control

Show Answer Comment (0)

Question 187

Which of the following is the MAIN reason that system re-certification and re-accreditation are needed?

To assist data owners in making future sensitivity and criticality determinations

To assure the software development team that all security issues have been addressed

To verify that security protection remains acceptable to the organizational security policy

To help the security team accept or reject new systems for implementation and production

Show Answer Comment (0)

Question 188

An external attacker has compromised an organization's network security perimeter and installed a sniffer onto an inside computer. Which of the following is the MOST effective layer of security the organization could have implemented to mitigate the attacker's ability to gain further information?

Implement packet filtering on the network firewalls

Require strong authentication for administrators

Install Host Based Intrusion Detection Systems (HIDS)

Implement logical network segmentation at the switches

Show Answer Comment (0)

Question 189

A security consultant has been asked to research an organization's legal obligations to protect privacy-related information. What kind of reading material is MOST relevant to this project?

The organization's current security policies concerning privacy issues

Privacy-related regulations enforced by governing bodies applicable to the organization

Privacy best practices published by recognized security standards organizations

Organizational procedures designed to protect privacy information

Show Answer Comment (0)