ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1:

  Which of the following statements is TRUE regarding value boundary analysis as a functional software testing technique?

  A. It is useful for testing communications protocols and graphical user interfaces.
  B. It is characterized by the stateless behavior of a process implemented in a function.
  C. Test inputs are obtained from the derived threshold of the given functional specifications.
  D. An entire partition can be covered by considering only one representative value from that partition.
  C. Test inputs are obtained from the derived threshold of the given functional specifications.

• Question 2:

  An application developer is deciding on the amount of idle session time that the application allows before a timeout. Which of the following is the BEST reason for determining the session timeout requirement?

  A. Application requirements
  B. Industry best practices
  C. Industry feedback
  D. Management feedback
  A. Application requirements

• Question 3:

  Which is MOST important when negotiating an Internet service provider (ISP) service-level agreement (SLA) by an organization that solely provides Voice over Internet Protocol (VoIP) services?

  A. Mean time to repair (MTTR)
  B. Quality of Service (QoS) between applications
  C. Availability of network services
  D. Financial penalties in case of disruption
  B. Quality of Service (QoS) between applications

• Question 4:

  Which of the following types of firewall only examines the "handshaking" between packets before forwarding traffic?

  A. Proxy firewalls
  B. Host-based firewalls
  C. Circuit-level firewalls
  D. Network Address Translation (NAT) firewalls
  C. Circuit-level firewalls

• Question 5:

  A mobile device application that restricts the storage of user information to just that which is needed to accomplish lawful business goals adheres to what privacy principle?

  A. Onward transfer
  B. Collection Limitation
  C. Collector Accountability
  D. Individual Participation
  B. Collection Limitation

• Question 6:

  An organization contracts with a consultant to perform a System Organization Control (SOC) 2 audit on their internal security controls. An auditor documents a finding related to an Application Programming Interface (API) performing an action that is not aligned with the scope or objective of the system. Which trust service principle would be MOST applicable in this situation?

  A. Processing Integrity
  B. Availability
  C. Confidentiality
  D. Security
  B. Availability

• Question 7:

  DRAG DROP

  A software security engineer is developing a black box-based test plan that will measure the system's reaction to incorrect or illegal inputs or unexpected operational errors and situations. Match the functional testing techniques on the left with the correct input parameters on the right.

  Select and Place:

  

  

• Question 8:

  Which of the following authorization standards is built to handle application programming interface (API) access for Federated identity management (FIM)?

  A. Terminal Access Controller Access Control System Plus (TACACS+)
  B. Open Authentication (OAuth)
  C. Remote Authentication Dial-In User Service (RADIUS)
  D. Security Assertion Markup Language (SAM)
  B. Open Authentication (OAuth)

• Question 9:

  Refer to the information below to answer the question.

  Desktop computers in an organization were sanitized for re-use in an equivalent security environment. The data was destroyed in accordance with organizational policy and all marking and other external indications of the sensitivity of the data that was formerly stored on the magnetic drives were removed.

  Organizational policy requires the deletion of user data from Personal Digital Assistant (PDA) devices before disposal. It may not be possible to delete the user data if the device is malfunctioning. Which destruction method below provides the BEST assurance that the data has been removed?

  A. Knurling
  B. Grinding
  C. Shredding
  D. Degaussing
  C. Shredding

• Question 10:

  Which of the following is the BEST network defense against unknown types of attacks or stealth attacks in progress?

  A. Intrusion Prevention Systems (IPS)
  B. Intrusion Detection Systems (IDS)
  C. Stateful firewalls
  D. Network Behavior Analysis (NBA) tools
  D. Network Behavior Analysis (NBA) tools