ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1091:

  Why should Open Wab Application Secuirty Project (OWASP) Application Security Verification standards (ASVS) Level 1 be considered a MINIMUM level of protection for any wab application?

  A. ASVS Level 1 ensures that applications are invulnerable to OWASP top 10 threats.
  B. Opportunistic attackers will look for any easily exploitable vulnerable applications.
  C. Most regulatory bodies consider ASVS Level 1 as a baseline set of controls for applications.
  D. Securing applications at ASVS Level 1 provides adequate protection for sensitive data.
  B. Opportunistic attackers will look for any easily exploitable vulnerable applications.

• Question 1092:

  Security Software Development Life Cycle (SDLC) expects application code to be written In a consistent manner to allow ease of auditing and which of the following?

  A. Protecting
  B. Executing
  C. Copying
  D. Enhancing
  A. Protecting

• Question 1093:

  What is the MAIN goal of information security awareness and training?

  A. To inform users of the latest malware threats
  B. To inform users of information assurance responsibilities
  C. To comply with the organization information security policy
  D. To prepare students for certification
  B. To inform users of information assurance responsibilities

• Question 1094:

  The core component of Role Based Access control (RBAC) must be constructed of defined data elements, Which elements are requried?

  A. Users, permissions, operators, and protected objects
  B. Users, rotes, operations, and protected objects
  C. Roles, accounts, permissions, and protected objects
  D. Roles, operations, accounts, and protected objects
  B. Users, rotes, operations, and protected objects

• Question 1095:

  Which of the following is critical if an employee is dismissed due to violation of an organization's Acceptable Use Policy (ALP)?

  A. Privilege suspension
  B. Internet access logs
  C. Proxy records
  D. Appropriate documentation
  D. Appropriate documentation

• Question 1096:

  A security professional needs to find a secure and efficient method of encrypting data on an endpoint. Which solution includes a root key?

  A. Bitlocker
  B. Trusted Platform Module (TPM)
  C. Virtual storage array network (VSAN)
  D. Hardware security module (HSM)
  D. Hardware security module (HSM)

• Question 1097:

  An information security professional is reviewing user access controls on a customer-facing application. The application must have multi-factor authentication (MFA) in place. The application currently requires a username and password to login. Which of the following options would BEST implement MFA?

  A. Geolocate the user and compare to previous logins
  B. Require a pre-selected number as part of the login
  C. Have the user answer a secret question that is known to them
  D. Enter an automatically generated number from a hardware token
  C. Have the user answer a secret question that is known to them

• Question 1098:

  When determining data and information asset handling, regardless of the specific toolset being used, which of the following is one of the common components of big data?

  A. Consolidated data collection
  B. Distributed storage locations
  C. Distributed data collection
  D. Centralized processing location
  C. Distributed data collection

• Question 1099:

  When implementing single sign-on (SSO) on a network, which authentication approach BEST allows users to use credentials across multiple applications?

  A. Public key infrastructure (PKI)
  B. Security Assertion Markup Language (SAML)
  C. Delegated Identity Management
  D. Federated Identity Management
  D. Federated Identity Management

• Question 1100:

  Which of the following is the MOST effective strategy to prevent an attacker from disabling a network?

  A. Test business continuity and disaster recovery (DR) plans.
  B. Design networks with the ability to adapt, reconfigure, and fail over.
  C. Implement network segmentation to achieve robustness.
  D. Follow security guidelines to prevent unauthorized network access.
  D. Follow security guidelines to prevent unauthorized network access.