ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1021:

  A vulnerability assessment report has been submitted to a client. The client indicates that one third of the hosts that were in scope are missing from the report. In which phase of the assessment was this error MOST likely made?

  A. Enumeration
  B. Reporting
  C. Detection
  D. Discovery
  A. Enumeration

• Question 1022:

  An organization is establishing a privacy program to ensure that personally identifiable information (PII) is properly protected. What is the FIRST action the organization should take to establish the program?

  A. Appoint a senior official to oversee the privacy program.
  B. Allocate sufficient resources to implement the privacy program.
  C. Develop a strategic organizational privacy plan.
  D. Monitor privacy laws and policy changes.
  A. Appoint a senior official to oversee the privacy program.

• Question 1023:

  Following a penetration test, what should an organization do FIRST?

  A. Review all security policies and procedures
  B. Ensure staff is trained in security
  C. Determine if you need to conduct a full security assessment
  D. Evaluate the problems identified in the test result
  D. Evaluate the problems identified in the test result

• Question 1024:

  Which of the following vulnerabilities can be BEST detected using automated analysis?

  A. Valid cross-site request forgery (CSRF) vulnerabilities
  B. Multi-step process attack vulnerabilities
  C. Business logic flaw vulnerabilities
  D. Typical source code vulnerabilities
  D. Typical source code vulnerabilities

• Question 1025:

  Which of the following access management procedures would minimize the possibility of an organization's employees retaining access to secure werk areas after they change roles?

  A. User access modification
  B. user access recertification
  C. User access termination
  D. User access provisioning
  B. user access recertification

• Question 1026:

  Which of the following is TRUE regarding equivalence class testing?

  A. It is characterized by the stateless behavior of a process implemented In a function.
  B. An entire partition can be covered by considering only one representative value from that partition.
  C. Test inputs are obtained from the derived boundaries of the given functional specifications.
  D. It is useful for testing communications protocols and graphical user interfaces.
  B. An entire partition can be covered by considering only one representative value from that partition.

• Question 1027:

  Which Radio Frequency Interference (RFI) phenomenon associated with bundled cable runs can create information leakage?

  A. Transference
  B. Covert channel
  C. Bleeding
  D. Cross-talk
  D. Cross-talk

• Question 1028:

  Which of the following is the BEST method a security practitioner can use to ensure that systems and sub-system gracefully handle invalid input?

  A. Negative testing
  B. Integration testing
  C. Unit testing
  D. Acceptance testing
  A. Negative testing

• Question 1029:

  Using Address Space Layout Randomization (ASLR) reduces the potential for which of the following attacks?

  A. SQL injection (SQLi)
  B. Man-in-the-middle (MITM)
  C. Cross-Site Scripting (XSS)
  D. Heap overflow
  D. Heap overflow

• Question 1030:

  In the area of disaster planning and recovery, what strategy entails the presentation of information about the plan?

  A. Communication
  B. Planning
  C. Recovery
  D. Escalation
  A. Communication