ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 101:

  When designing a Cyber-Physical System (CPS), which of the following should be a security practitioner's first consideration?

  A. Detection of sophisticated attackers
  B. Resiliency of the system
  C. Topology of the network used for the system
  D. Risk assessment of the system
  B. Resiliency of the system

• Question 102:

  An organization plans to acquire @ commercial off-the-shelf (COTS) system to replace their aging home-built reporting system. When should the organization's security team FIRST get involved in this acquisition's life cycle?

  A. When the system is being designed, purchased, programmed, developed, or otherwise constructed
  B. When the system is verified and validated
  C. When the system is deployed into production
  D. When the need for a system is expressed and the purpose of the system Is documented
  D. When the need for a system is expressed and the purpose of the system Is documented

• Question 103:

  Which of the following sets of controls should allow an investigation if an attack is not blocked by preventive controls or detected by monitoring?

  A. Logging and audit trail controls to enable forensic analysis
  B. Security incident response lessons learned procedures
  C. Security event alert triage done by analysts using a Security Information and Event Management (SIEM) system
  D. Transactional controls focused on fraud prevention
  C. Security event alert triage done by analysts using a Security Information and Event Management (SIEM) system

• Question 104:

  Which of the following is BEST suited for exchanging authentication and authorization messages in a multi-party decentralized environment?

  A. Lightweight Directory Access Protocol (LDAP)
  B. Security Assertion Markup Language (SAML)
  C. Internet Mail Access Protocol
  D. Transport Layer Security (TLS)
  B. Security Assertion Markup Language (SAML)

• Question 105:

  What is the BEST control to be implemented at a login page in a web application to mitigate the ability to enumerate users?

  A. Implement a generic response for a failed login attempt.
  B. Implement a strong password during account registration.
  C. Implement numbers and special characters in the user name.
  D. Implement two-factor authentication (2FA) to login process.
  A. Implement a generic response for a failed login attempt.

• Question 106:

  A company-wide penetration test result shows customers could access and read files through a web browser. Which of the following can be used to mitigate this vulnerability?

  A. Enforce the chmod of files to 755
  B. Enforce the control of file directory listings
  C. Implement access control on the web server
  D. Implement Secure Sockets Layer (SSL) certificates throughout the web server
  D. Implement Secure Sockets Layer (SSL) certificates throughout the web server

• Question 107:

  For privacy protected data, which of the following roles has the highest authority for establishing dissemination rules for the data?

  A. Information Systems Security Officer
  B. Data Owner
  C. System Security Architect
  D. Security Requirements Analyst
  B. Data Owner

• Question 108:

  An organization has implemented a password complexity and an account lockout policy enforcing five incorrect logins tries within ten minutes. Network users have reported significantly increased account lockouts. Which of the following security principles is this company affecting?

  A. Availability
  B. Integrity
  C. Confidentiality
  D. Authentication
  A. Availability

• Question 109:

  Contingency plan exercises are intended to do which of the following?

  A. Train personnel in roles and responsibilities
  B. Validate service level agreements
  C. Train maintenance personnel
  D. Validate operation metrics
  A. Train personnel in roles and responsibilities

• Question 110:

  An application developer is deciding on the amount of idle session time that the application allows before a timeout. The BEST reason for determining the session timeout requirement is

  A. organization policy.
  B. industry best practices.
  C. industry laws and regulations.
  D. management feedback.
  A. organization policy.