Which of the following actions will reduce risk to a laptop before traveling to a high risk area?

Examine the device for physical tampering

Implement more stringent baseline configurations

Purge or re-image the hard disk drive

Which of the following represents the GREATEST risk to data confidentiality?

Backup tapes are generated unencrypted

Network redundancies are not implemented

Security awareness training is not completed

Backup tapes are generated unencrypted

Users have administrative privileges

What is the MOST important consideration from a data security perspective when an organization plans to relocate?

Conduct a gap analysis of a new facilities against existing security requirements

Ensure the fire prevention and detection systems are sufficient to protect personnel

Review the architectural plans to determine how many emergency exits are present

Conduct a gap analysis of a new facilities against existing security requirements

Revise the Disaster Recovery and Business Continuity (DR/BC) plan

When assessing an organization's security policy according to standards established by the International Organization for Standardization (ISO) 27001 and 27002, when can management responsibilities be defined?

Only when assets are clearly defined

Only when standards are defined

Only when controls are put in place

Which of the following types of technologies would be the MOST cost-effective method to provide a reactive control for protecting personnel in public areas?

Hire a guard to protect the public area

Install mantraps at the building entrances

Enclose the personnel entry area with polycarbonate plastic

Supply a duress alarm for personnel exposed to the public

Hire a guard to protect the public area

An important principle of defense in depth is that achieving information security requires a balanced focus on which PRIMARY elements?

People, technology, and operations

Development, testing, and deployment

Prevention, detection, and remediation

People, technology, and operations

Certification, accreditation, and monitoring

Intellectual property rights are PRIMARY concerned with which of the following?

Right of the owner to control delivery method

Owner's ability to realize financial gain

Owner's ability to maintain copyright

Right of the owner to enjoy their creation

Right of the owner to control delivery method

Which of the following is a PRIMARY benefit of using a formalized security testing report format and structure?

Technical and management teams will better understand the testing objectives, results of each test phase, and potential impact levels

Executive audiences will understand the outcomes of testing and most appropriate next steps for corrective actions to be taken

Technical teams will understand the testing objectives, testing strategies applied, and business risk associated with each vulnerability

Management teams will understand the testing objectives and reputational risk to the organization

Technical and management teams will better understand the testing objectives, results of each test phase, and potential impact levels

A continuous information security monitoring program can BEST reduce risk through which of the following?

Facilitating system-wide visibility into the activities of critical user accounts

Collecting security events and correlating them to identify anomalies

Facilitating system-wide visibility into the activities of critical user accounts

Encompassing people, process, and technology

Logging both scheduled and unscheduled system changes

Which of the following is the PRIMARY risk with using open source software in a commercial software construction?

Costs associated with support of the software

License agreements requiring release of modified code

Expiration of the license agreement

Costs associated with support of the software

Which one of these risk factors would be the LEAST important consideration in choosing a building site for a new computer facility?

Proximity to an airline flight path

Adjacent buildings and businesses

Proximity to an airline flight path

Vulnerability to natural disasters

Which of the following is a potential risk when a program runs in privileged mode?

It may allow malicious code to be inserted

It may serve to create unnecessary code complexity

It may not enforce job separation duties

It may create unnecessary application hardening

It may allow malicious code to be inserted

A risk assessment report recommends upgrading all perimeter firewalls to mitigate a particular finding. Which of the following BEST supports this recommendation?

The expected loss from the risk exceeds mitigation costs.

The inherent risk is greater than the residual risk.

The Annualized Loss Expectancy (ALE) approaches zero.

The expected loss from the risk exceeds mitigation costs.

The infrastructure budget can easily cover the upgrade costs.

Which of the following BEST describes the purpose of performing security certification?

To formalize the confirmation of compliance to security policies and standards

To identify system threats, vulnerabilities, and acceptable level of risk

To formalize the confirmation of compliance to security policies and standards

To formalize the confirmation of completed risk mitigation and risk analysis

To verify that system architecture and interconnections with other systems are effectively implemented

The BEST method to mitigate the risk of a dictionary attack on a system is to

encrypt the access control list (ACL).

In general, servers that are facing the Internet should be placed in a demilitarized zone (DMZ). What is MAIN purpose of the DMZ?

Reduced risk to internal systems.

Prepare the server for potential attacks.

Mitigate the risk associated with the exposed server.

Bypass the need for a firewall.

Which of the following is the BEST reason for the use of security metrics?

They provide an appropriate framework for Information Technology (IT) governance.

They ensure that the organization meets its security objectives.

They provide an appropriate framework for Information Technology (IT) governance.

They speed up the process of quantitative risk assessment.

They quantify the effectiveness of security processes.

An international medical organization with headquarters in the United States (US) and branches in France wants to test a drug in both countries. What is the organization allowed to do with the test subject's data?

Aggregate it into one database in the US

Process it in the US, but store the information in France

Anonymize it and process it in the US

Which of the following is the MOST significant benefit to implementing a third-party federated identity architecture?

Reduction in operational costs to the agency

Attribute assertions as agencies can request a larger set of attributes to fulfill service delivery

Data decrease related to storing personal information

Reduction in operational costs to the agency

Enable business objectives so departments can focus on mission rather than the business of identity management

Which of the following methods MOST efficiently manages user accounts when using a third-party cloud-based application and directory solution?

Lightweight Directory Access Protocol (LDAP)

An organization is outsourcing its payroll system and is requesting to conduct a full audit on the thirdparty information technology (IT) systems. During the due diligence process, the third party provides previous audit report on its IT system.Which of the following MUST be considered by the organization in order for the audit reports to be acceptable?

The audit reports have been signed by the third-party senior management.

The audit assessment has been conducted by an independent assessor.

The audit reports have been signed by the third-party senior management.

The audit reports have been issued in the last six months.

The audit assessment has been conducted by an international audit firm.

A risk assessment report recommends upgrading all perimeter firewalls to mitigate a particular finding. Which of the following BEST supports this recommendation?

The expected loss from the risk exceeds mitigation costs.

The inherent risk is greater than the residual risk.

The Annualized Loss Expectancy (ALE) approaches zero.

The expected loss from the risk exceeds mitigation costs.

The infrastructure budget can easily cover the upgrade costs.

The primary objectives of a healthcare system include all of the following except:

Delivering healthcare services using the most current technology, regardless of cost

Enabling all citizens to receive healthcare services

Delivering healthcare services that are cost-effective

Delivering healthcare services using the most current technology, regardless of cost

Delivering healthcare services that meet established standards of quality

The role of the government in the U.S. healthcare system is:

Medicare and Medicaid reimbursement rate-setter

Which of the following is a characteristic of a socialized health insurance system?

Health care is financed through government-mandated contributions by employers and employees

Health care is delivered by government-employed providers

Which of the following is an overarching goal of Healthy People 2010?

Increase quality and years of healthy life

Create a more coordinated health care system

Establish a national health insurance program

Increase quality and years of healthy life

In a free market who would pay for the delivery of health care services?

numerous health insurance companies

A multiple payer system is more cumbersome than a single payer system for all of the following reasons except:

Some healthcare services are covered for people in the north, but not in the south

There are numerous health plans, which is difficult for providers to handle

Payments are not standardized across health plans

Some healthcare services are covered for people in the north, but not in the south

Government programs required extensive documentation proving services were provided before paying providers

ISC HCISPP Practice Test 2 - Free Online Exam Prep & Questions

All of the following items should be included in a Business Impact Analysis (BIA) Question:naire EXCEPT Question:s that

determine the risk of a business interruption occurring

determine the technological dependence of the business processes

Identify the operational impacts of a business interruption

Identify the financial impacts of a business interruption

Comment (0)

ISC HCISPP Practice Test 2

Question

ISC HCISPP Practice Tests

Practice Tests