ISC CISSP-ISSEP Online Practice Questions and Exam Preparation

ISC CISSP-ISSEP Online Questions & Answers

• Question 111:

  Which of the following statements is true about residual risks

  A. It can be considered as an indicator of threats coupled with vulnerability.
  B. It is a weakness or lack of safeguard that can be exploited by a threat.
  C. It is the probabilistic risk after implementing all security measures.
  D. It is the probabilistic risk before implementing all security measures.
  C. It is the probabilistic risk after implementing all security measures.

• Question 112:

  Which of the following DITSCAP CandA phases takes place between the signing of the initial version of the SSAA and the formal accreditation of the system A. Phase 3

  B. Phase 2
  C. Phase 4
  D. Phase 1
  B. Phase 2

• Question 113:

  Which of the following DoD directives is referred to as the Defense Automation Resources Management Manual

  A. DoD 8910.1
  B. DoD 7950.1-M
  C. DoD 5200.22-M
  D. DoD 5200.1-R
  E. DoDD 8000.1
  B. DoD 7950.1-M

• Question 114:

  Which of the following is a temporary approval to operate based on an assessment of the implementation status of the assigned IA Controls

  A. IATO
  B. DATO
  C. ATO
  D. IATT
  A. IATO

• Question 115:

  The Concept of Operations (CONOPS) is a document describing the characteristics of a proposed system from the viewpoint of an individual who will use that system. Which of the following points are included in CONOPS Each correct answer represents a complete solution. Choose all that apply.

  A. Strategies, tactics, policies, and constraints affecting the system
  B. Organizations, activities, and interactions among participants and stakeholders
  C. Statement of the structure of the system
  D. Clear statement of responsibilities and authorities delegated
  E. Statement of the goals and objectives of the system
  A. Strategies, tactics, policies, and constraints affecting the system
  B. Organizations, activities, and interactions among participants and stakeholders
  D. Clear statement of responsibilities and authorities delegated
  E. Statement of the goals and objectives of the system

• Question 116:

  Which of the following principles are defined by the IATF model Each correct answer represents a complete solution. Choose all that apply.

  A. The degree to which the security of the system, as it is defined, designed, and implemented, meets the security needs.
  B. The problem space is defined by the customer's mission or business needs.
  C. The systems engineer and information systems security engineer define the solution space, which is driven by the problem space.
  D. Always keep the problem and solution spaces separate.
  B. The problem space is defined by the customer's mission or business needs.
  C. The systems engineer and information systems security engineer define the solution space, which is driven by the problem space.
  D. Always keep the problem and solution spaces separate.

• Question 117:

  Della works as a security engineer for BlueWell Inc. She wants to establish configuration management and control procedures that will document proposed or actual changes to the information system. Which of the following phases of NIST SP 800-37 CandA methodology will define the above task

  A. Security Certification
  B. Security Accreditation
  C. Initiation
  D. Continuous Monitoring
  D. Continuous Monitoring

• Question 118:

  Which of the following acts assigns the Chief Information Officers (CIO) with the responsibility to develop Information Technology Architectures (ITAs) and is also referred to as the Information Technology Management Reform Act (ITMRA)

  A. Paperwork Reduction Act
  B. Computer Misuse Act
  C. Lanham Act
  D. Clinger Cohen Act
  D. Clinger Cohen Act

• Question 119:

  In which of the following DIACAP phases is residual risk analyzed

  A. Phase 2
  B. Phase 3
  C. Phase 5
  D. Phase 1
  E. Phase 4
  E. Phase 4

• Question 120:

  Fill in the blank with the appropriate phrase. __________ provides instructions and directions for completing the Systems Security Authorization Agreement (SSAA).

  DoDI 5200.40