Which of the following are the process steps of OPSEC? Each correct answer represents a part of the solution. Choose all that apply.

Identification of Critical Information

Display of associated vulnerability components

Identification of Critical Information

Which of the following are the responsibilities of the owner with regard to data in an information classification program? Each correct answer represents a complete solution. Choose three.

Determining what level of classification the information requires.

Delegating the responsibility of the data protection duties to a custodian.

Reviewing the classification assignments at regular time intervals and making changes as the business needs change.

Determining what level of classification the information requires.

Delegating the responsibility of the data protection duties to a custodian.

Reviewing the classification assignments at regular time intervals and making changes as the business needs change.

Running regular backups and routinely testing the validity of the backup data.

You work as the Network Administrator for a defense contractor. Your company works with sensitive materials and all IT personnel have at least a secret level clearance. You are still concerned that one individual could perhaps compromise the network (intentionally or unintentionally) by setting up improper or unauthorized remote access. What is the best way to avoid this problem?

Implement separation of duties.

Implement three way authentication.

Which of the following statements is true about auditing?

It is used to track user accounts for file and object access, logon attempts, etc.

It is used to protect the network against virus attacks.

It is used to track user accounts for file and object access, logon attempts, etc.

It is used to secure the network or the computers on the network.

It is used to prevent unauthorized access to network resources.

Your project team has identified a project risk that must be responded to. The risk has been recorded in the risk register and the project team has been discussing potential risk responses for the risk event. The event is not likely to happen for several months but the probability of the event is high. Which one of the following is a valid response to the identified risk event?

Technical performance measurement

Rachael is the project manager for a large project in her organization. A new change request has been proposed that will affect several areas of the project. One area of the project change impact is on work that a vendor has already completed. The vendor is refusing to make the changes as they've already completed the project work they were contracted to do. What can Rachael do in this instance?

Refer to the contract agreement for direction.

Threaten to sue the vendor if they don't complete the work.

Fire the vendor for failing to complete the contractual obligation.

Withhold the vendor's payments for the work they've completed.

Refer to the contract agreement for direction.

How can you calculate the Annualized Loss Expectancy (ALE) that may occur due to a threat?

Single Loss Expectancy (SLE) X Annualized Rate of Occurrence (ARO)

Single Loss Expectancy (SLE)/ Exposure Factor (EF)

Asset Value X Exposure Factor (EF)

Exposure Factor (EF)/Single Loss Expectancy (SLE)

Single Loss Expectancy (SLE) X Annualized Rate of Occurrence (ARO)

Which of the following test methods has the objective to test the IT system from the viewpoint of a threat-source and to identify potential failures in the IT system protection schemes?

Security Test and Evaluation (ST&E)

Automated vulnerability scanning tool

Which of the following statements reflect the 'Code of Ethics Preamble' in the '(ISC)2 Code of Ethics'? Each correct answer represents a complete solution.Choose all that apply.

Strict adherence to this Code is a condition of certification.

Safety of the commonwealth, duty to our principals, and to each other requires that we adhere, and be seen to adhere, to the highest ethical standards of behavior.

Strict adherence to this Code is a condition of certification.

Safety of the commonwealth, duty to our principals, and to each other requires that we adhere, and be seen to adhere, to the highest ethical standards of behavior.

Advance and protect the profession.

Provide diligent and competent service to principals.

Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur?

Annualized Rate of Occurrence (ARO)

Which of the following statements is related with the second law of OPSEC?

If you don't know what to protect, how do you know you are protecting it?

If you are not protecting it (the critical and sensitive information), the adversary wins!

If you don't know what to protect, how do you know you are protecting it?

If you don't know about your security resources you could not protect your network.

If you don't know the threat, how do you know what to protect?

Which of the following elements of BCP process includes the areas of plan implementation, plan testing, and ongoing plan maintenance, and also involves defining and documenting the continuity strategy?

Business continuity plan development

Plan approval and implementation

Which of the following Acts enacted in United States allows the FBI to issue National Security Letters (NSLs) to Internet service providers (ISPs) ordering them to disclose records about their customers?

Electronic Communications Privacy Act of 1986

You work as a Product manager for Marioiss Inc. You have been tasked to start a project for securing the network of your company. You want to employ configuration management to efficiently manage the procedures of the project. What will be the benefits of employing configuration management for completing this project? Each correct answer represents a complete solution. Choose all that apply.

It provides a live documentation of the project.

It provides the versions for network devices.

It provides object, orient, decide and act strategy.

It provides a live documentation of the project.

It provides the risk analysis of project configurations.

It provides the versions for network devices.

You company suspects an employee of sending unauthorized emails to competitors. These emails are alleged to contain confidential company dat a. Which of the following is the most important step for you to take in preserving the chain of custody?

Preserve the email server including all logs.

Make copies of that employee's email.

Place spyware on the employee's PC to confirm these activities.

ISC CISSP-ISSMP Practice Test 4 - Free Online Exam Prep & Questions

Which of the following architecturally related vulnerabilities is a hardware or software mechanism, which was installed to permit system maintenance and to bypass the system's security protections?

Become a Premium Member for full access

Unlock Premium Member

ISC CISSP-ISSMP Practice Test 4

Question

ISC CISSP-ISSMP Practice Tests

Practice Tests