Free CISSP Exam Dumps Preview

A hospital has three data classification levels: shareable without restrictions, shareable with restrictions, and internal use only.

Which of the following BEST demonstrates adhering to principles of good enterprise data classification?

Using Address Space Layout Randomization (ASLR) reduces the potential for which of the following attacks?

A security practitioner has just been assigned to address an ongoing Denial of Service (DoS) attack against the company's network, which includes an e-commerce web site. The strategy has to include defenses for any size of attack without rendering the company network unusable.

Which of the following should be a PRIMARY concern when addressing this issue?

Which of the following types of datacenter architectures will MOST likely be used in a large SDN and can be extended beyond the datacenter?

Refer to the information below to answer the question.

A security practitioner detects client-based attacks on the organization's network. A plan will be necessary to address these concerns.

In the plan, what is the BEST approach to mitigate future internal client-based attacks?

Refer to the information below to answer the question.

An organization experiencing a negative financial impact is forced to reduce budgets and the number of Information Technology (IT) operations staff performing basic logical access security administration functions. Security processes have been tightly integrated into normal IT operations and are not separate and distinct roles.

Which of the following will be the PRIMARY security concern as staff is released from the organization?

Which of the following types of devices can provide content filtering and threat protection, and manage multiple IPSec site-to-site connections?

Company A is evaluating new software to replace an in-house developed application.
During the acquisition process. Company A specified the security retirement, as well as the functional requirements.

Company B responded to the acquisition request with their flagship product that runs on an Operating System (OS) that Company A has never used nor evaluated.
The flagship product meets all security -and functional requirements as defined by Company A.

Based upon Company B's response, what step should Company A take?

In general, servers that are facing the Internet should be placed in a demilitarized zone (DMZ).

What is MAIN purpose of the DMZ?

An organization wants a service provider to authenticate users via the users' organization domain credentials.

Which markup language should the organization's security personnel use to support the integration?

Which of the following are common components of a Security Assertion Markup Language (SAML) based federation system?

Changes to a Trusted Computing Base (TCB) system that could impact the security posture of that system and trigger a recertification activity are documented in the

According to best practice, which of the following groups is the MOST effective in performing an information security compliance audit?

As a best practice, the Security Assessment Report (SAR) should include which of the following sections?

Which one of the following describes granularity?

Which of the following is the PRIMARY security concern associated with the implementation of smart cards?

What is the BEST approach to addressing security issues in legacy web applications?

In order to assure authenticity, which of the following are required?

Which of the following regulations dictates how data breaches are handled?

The use of private and public encryption keys is fundamental in the implementation of which of the following?

An organization with divisions in the United States (US) and the United Kingdom (UK) processes data comprised of personal information belonging to subjects living in the European Union (EU) and in the US.

Which data MUST be handled according to the privacy protections of General Data Protection Regulation (GDPR)?

Which of the following is the MOST important output from a mobile application threat modeling exercise according to Open Web Application Security Project (OWASP)?

Which of the following will help prevent improper session handling?

A Simple Power Analysis (SPA) attack against a device directly observes which of the following?

Checking routing information on e-mail to determine it is in a valid format and contains valid information is an example of which of the following anti-spam approaches?

Which of the following is the FIRST step in the incident response process?

While classifying credit card data related to Payment Card Industry Data Security Standards (PCI-DSS), which of the following is a PRIMARY security requirement?

Which of the following practices provides the development of security and identification of threats in designing software?

How long should the records on a project be retained?

What is considered the BEST explanation when determining whether to provide remote network access to a third-party security service?

Which of the following PRIMARILY contributes to security incidents in web-based applications?

What is a common mistake in records retention?

Which one of the following is a fundamental objective in handling an incident?

A security professional recommends that a company integrate threat modeling into its Agile development processes.

Which of the following BEST describes the benefits of this approach?

Which of the following protocols will allow the encrypted transfer of content on the Internet?

After a thorough analysis, it was discovered that a perpetrator compromised a network by gaining access to the network through a Secure Socket Layer (SSL) Virtual Private Network (VPN) gateway. The perpetrator guessed a username and brute forced the password to gain access.

Which of the following BEST mitigates this issue?

Refer to the information below to answer the question.

In a Multilevel Security (MLS) system, the following sensitivity labels are used in increasing levels of sensitivity: restricted, confidential, secret, top secret. Table A lists the clearance levels for four users, while Table B lists the security classes of four different files.

In a Bell-LaPadula system, which user cannot write to File 3?

What is the MOST appropriate hierarchy of documents when implementing a security program?

How is protection for hypervisor host and software administration functions BEST achieved?

An application developer is deciding on the amount of idle session time that the application allows before a timeout.

Which of the following is the BEST reason for determining the session timeout requirement?

What type of risk is related to the sequences of value-adding and managerial activities undertaken in an organization?

When are security requirements the LEAST expensive to implement?

In order to support the least privilege security principle when a resource is transferring within the organization from a production support system administration role to a developer role, what changes should be made to that resource's access to the production Operating System (OS) directory structure?

What is an important characteristic of Role Based Access Control (RBAC)?

An organization is looking to include mobile devices in its asset management system for better tracking.
In which system tier of the reference architecture would mobile devices be tracked?

Which of the following is a process within a Systems Engineering Life Cycle (SELC) stage?

Which of the following addresses requirements of security assessment during software acquisition?

Refer to the information below to answer the question.

A large, multinational organization has decided to outsource a portion of their Information Technology (IT) organization to a third-party provider's facility. This provider will be responsible for the design, development, testing, and support of several critical, customer-based applications used by the organization.

What additional considerations are there if the third party is located in a different country?

When implementing controls in a heterogeneous end-point network for an organization, it is critical that

Which of the following phases involves researching a target's configuration from public sources when performing a penetration test?

Which of the following countermeasures is the MOST effective in defending against a social engineering attack?

What is the BEST approach for maintaining ethics when a security professional is unfamiliar with the culture of a country and is asked to perform a questionable task?

Which of the following are core categories of malicious attack against Internet of Things (IOT) devices?

DRAG DROP

Match the types of e-authentication tokens to their description.
Drag each e-authentication token on the left to its corresponding description on the right.

What is the PRIMARY benefit of incident reporting and computer crime investigations?

Recovery strategies of a Disaster Recovery planning (DRIP) MUST be aligned with which of the following?

What type of wireless network attack BEST describes an Electromagnetic Pulse (EMP) attack?

An Internet media company produces and broadcasts highly popular television shows. The company is suffering a huge revenue loss due to piracy.

What technique should be used to track the distribution of content?

Refer to the information below to answer the question.

A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant messaging. The organization's Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access.

Which of the following methods is the MOST effective way of removing the Peer-to-Peer (P2P) program from the computer?

Creation and maintenance of intrusion detection systems and processes for the following is one of them identify it:

The MAIN use of Layer 2 Tunneling Protocol (L2TP) is to tunnel data

Which of the following is the top barrier for companies to adopt cloud technology?

A Distributed Denial of Service (DDoS) attack was carried out using malware called Mirai to create a large-scale command and control system to launch a botnet.

Which of the following devices were the PRIMARY sources used to generate the attack traffic?

Transport Layer Security (TLS) provides which of the following capabilities for a remote access server?

Which of the following MOST accurately describes the Security Target (ST) in the Common Criteria framework?

Which of the following media is LEAST problematic with data remanence?

Copyright provides protection for which of the following?

Even though a particular digital watermark is difficult to detect, which of the following represents a way it might still be inadvertently removed?

Which of the following is the PRIMARY objective of performing scans with an active discovery tool?

What MUST each information owner do when a system contains data from multiple information owners?

Which of the following is MOST important when determining appropriate countermeasures for an identified risk?

A security professional should consider the protection of which of the following elements FIRST when developing a defense-in-depth strategy for a mobile workforce?

Which of the following controls is the FIRST step in protecting privacy in an information system?

A security practitioner has been tasked with establishing organizational asset handling procedures.

What should be considered that would have the GRFATEST impact to the development of these procedures?

Which of the following authorization standards is built to handle Application Programming Interface (API) access for Federated Identity Management (FIM)?

Which one of the following is the MOST important in designing a biometric access system if it is essential that no one other than authorized individuals are admitted?

What does a Synchronous (SYN) flood attack do?

Which of the following protocols would allow an organization to maintain a centralized list of users that can read a protected webpage?

An organization is establishing a privacy program to ensure that personally identifiable information (PII) is properly protected.

What is the FIRST action the organization should take to establish the program?

What is the MOST important reason to configure unique user IDs?

What security principle addresses the issue of "Security by Obscurity"?

Which of the following will an organization's network vulnerability testing process BEST enhance?

By allowing storage communications to run on top of Transmission Control Protocol/Internet Protocol (TCP/IP) with a Storage Area Network (SAN), the

Why should Open Wab Application Secuirty Project (OWASP) Application Security Verification standards (ASVS) Level 1 be considered a MINIMUM level of protection for any wab application?

During an audit, the auditor finds evidence of potentially illegal activity.

Which of the following is the MOST appropriate action to take?

A malicious user gains access to unprotected directories on a web server.

Which of the following is MOST likely the cause for this information disclosure?

What high Availability (HA) option of database allows multiple clients to access multiple database servers simultaneously?

Which of the following is the MOST appropriate control for asset data labeling procedures?

Which access control method is based on users issuing access requests on system resources, features assigned to those resources, the operational or situational context, and a set of policies specified in terms of those features and context?

Which of the following is the GREATEST benefit of implementing a Role Based Access Control (RBAC) system?

Single Sign-On (SSO) is PRIMARILY designed to address which of the following?

Which of the following is the PRIMARY reason a sniffer operating on a network is collecting packets only from its own host?

Which of the following is used to detect steganography?

Which of the following would qualify as an exception to the "right to be forgotten" of the General Data Protection Regulation's (GDPR)?

Which of the following is a strategy of grouping requirements in developing a security test and Evaluation (ST&E)?

"Stateful" differs from "Static" packet filtering firewalls by being aware of which of the following?

Which of the following provides the BEST method to verify that security baseline configurations are maintained?

Which of the following defines the key exchange for Internet Protocol Security (IPSec)?

Alternate encoding such as hexadecimal representations is MOST often observed in which of the following forms of attack?

Discretionary Access Control (DAC) is based on which of the following?