ExamGecko
Home Home / ISC / CISSP

ISC CISSP Practice Test - Questions Answers, Page 33

Question list
Search
Search

How does an organization verify that an information system's current hardware and software match the standard system configuration?

A.
By reviewing the configuration after the system goes into production
A.
By reviewing the configuration after the system goes into production
Answers
B.
By running vulnerability scanning tools on all devices in the environment
B.
By running vulnerability scanning tools on all devices in the environment
Answers
C.
By comparing the actual configuration of the system against the baseline
C.
By comparing the actual configuration of the system against the baseline
Answers
D.
By verifying all the approved security patches are implemented
D.
By verifying all the approved security patches are implemented
Answers
Suggested answer: C

The goal of a Business Continuity Plan (BCP) training and awareness program is to

A.
enhance the skills required to create, maintain, and execute the plan.
A.
enhance the skills required to create, maintain, and execute the plan.
Answers
B.
provide for a high level of recovery in case of disaster.
B.
provide for a high level of recovery in case of disaster.
Answers
C.
describe the recovery organization to new employees.
C.
describe the recovery organization to new employees.
Answers
D.
provide each recovery team with checklists and procedures.
D.
provide each recovery team with checklists and procedures.
Answers
Suggested answer: A

Which of the following disaster recovery test plans will be MOST effective while providing minimal risk?

A.
Read-through
A.
Read-through
Answers
B.
Parallel
B.
Parallel
Answers
C.
Full interruption
C.
Full interruption
Answers
D.
Simulation
D.
Simulation
Answers
Suggested answer: D

An organization has developed a major application that has undergone accreditation testing. After receiving the results of the evaluation, what is the final step before the application can be accredited?

A.
Acceptance of risk by the authorizing official
A.
Acceptance of risk by the authorizing official
Answers
B.
Remediation of vulnerabilities
B.
Remediation of vulnerabilities
Answers
C.
Adoption of standardized policies and procedures
C.
Adoption of standardized policies and procedures
Answers
D.
Approval of the System Security Plan (SSP)
D.
Approval of the System Security Plan (SSP)
Answers
Suggested answer: A

What is one way to mitigate the risk of security flaws in custom software?

A.
Include security language in the Earned Value Management (EVM) contract
A.
Include security language in the Earned Value Management (EVM) contract
Answers
B.
Include security assurance clauses in the Service Level Agreement (SLA)
B.
Include security assurance clauses in the Service Level Agreement (SLA)
Answers
C.
Purchase only Commercial Off-The-Shelf (COTS) products
C.
Purchase only Commercial Off-The-Shelf (COTS) products
Answers
D.
Purchase only software with no open source Application Programming Interfaces (APIs)
D.
Purchase only software with no open source Application Programming Interfaces (APIs)
Answers
Suggested answer: B

Which of the following is the BEST example of weak management commitment to the protection of security assets and resources?

A.
poor governance over security processes and procedures
A.
poor governance over security processes and procedures
Answers
B.
immature security controls and procedures
B.
immature security controls and procedures
Answers
C.
variances against regulatory requirements
C.
variances against regulatory requirements
Answers
D.
unanticipated increases in security incidents and threats
D.
unanticipated increases in security incidents and threats
Answers
Suggested answer: A

What does an organization FIRST review to assure compliance with privacy requirements?

A.
Best practices
A.
Best practices
Answers
B.
Business objectives
B.
Business objectives
Answers
C.
Legal and regulatory mandates
C.
Legal and regulatory mandates
Answers
D.
Employee's compliance to policies and standards
D.
Employee's compliance to policies and standards
Answers
Suggested answer: C

Which security approach will BEST minimize Personally Identifiable Information (PII) loss from a data breach?

A.
A strong breach notification process
A.
A strong breach notification process
Answers
B.
Limited collection of individuals' confidential data
B.
Limited collection of individuals' confidential data
Answers
C.
End-to-end data encryption for data in transit
C.
End-to-end data encryption for data in transit
Answers
D.
Continuous monitoring of potential vulnerabilities
D.
Continuous monitoring of potential vulnerabilities
Answers
Suggested answer: B

An organization lacks a data retention policy. Of the following, who is the BEST person to consult for such requirement?

A.
Application Manager
A.
Application Manager
Answers
B.
Database Administrator
B.
Database Administrator
Answers
C.
Privacy Officer
C.
Privacy Officer
Answers
D.
Finance Manager
D.
Finance Manager
Answers
Suggested answer: C

Which of the following analyses is performed to protect information assets?

A.
Business impact analysis
A.
Business impact analysis
Answers
B.
Feasibility analysis
B.
Feasibility analysis
Answers
C.
Cost benefit analysis
C.
Cost benefit analysis
Answers
D.
Data analysis
D.
Data analysis
Answers
Suggested answer: A
Total 1.482 questions
Go to page: of 149