ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1111:

  A security team member was selected as a member of a Change Control Board (CCB) for an organization. Which of the following is one of their responsibilities?

  A. Approving or disapproving the change
  B. Determining the impact of the change
  C. Carrying out the requested change
  D. Logging the change
  B. Determining the impact of the change

• Question 1112:

  What requirement MUST be met during internal security audits to ensure that all information provided is expressed as an objective assessment without risk of retaliation?

  A. The auditor must be independent and report directly to the management
  B. The auditor must utilize automated tools to back their findings
  C. The auditor must work closely with both the Information Technology (IT) and security sections of an organization
  D. The auditor must perform manual reviews of systems and processes
  A. The auditor must be independent and report directly to the management

• Question 1113:

  When resolving ethical conflicts, the information security professional MUST consider many factors. In what order should these considerations be prioritized?

  A. Public safety, duties to individuals, duties to the profession, and duties to principals
  B. Public safety, duties to principals, duties to individuals, and duties to the profession
  C. Public safety, duties to the profession, duties to principals, and duties to individuals
  D. Public safety, duties to principals, duties to the profession, and duties to individuals
  B. Public safety, duties to principals, duties to individuals, and duties to the profession

• Question 1114:

  Which of the following is the PRIMARY mechanism used to limit the range of objects available to a given subject within different execution domains?

  A. Process isolation
  B. Data hiding and abstraction
  C. Use of discrete layering and Application Programming Interfaces (API)
  D. Virtual Private Network (VPN)
  C. Use of discrete layering and Application Programming Interfaces (API)

• Question 1115:

  An organization is outsourcing its payroll system and is requesting to conduct a full audit on the third-party information technology (IT) systems. During the due diligence process, the third party provides previous audit report on its IT system. Which of the following MUST be considered by the organization in order for the audit reports to be acceptable?

  A. The audit assessment has been conducted by an independent assessor.
  B. The audit reports have been signed by the third-party senior management.
  C. The audit reports have been issued in the last six months.
  D. The audit assessment has been conducted by an international audit firm.
  A. The audit assessment has been conducted by an independent assessor.

• Question 1116:

  When conducting a security assessment of access controls, which activity is part of the data analysis phase?

  A. Present solutions to address audit exceptions.
  B. Conduct statistical sampling of data transactions.
  C. Categorize and identify evidence gathered during the audit.
  D. Collect logs and reports.
  C. Categorize and identify evidence gathered during the audit.

• Question 1117:

  Which of the following is the MOST important activity an organization performs to ensure that security is part of the overall organization culture?

  A. Perform formal reviews of security incidents.
  B. Work with senior management to meet business goals.
  C. Ensure security policies are issued to all employees.
  D. Manage a program of security audits.
  A. Perform formal reviews of security incidents.

• Question 1118:

  What is the PRIMARY role of a scrum master in agile development?

  A. To choose the primary development language
  B. To choose the integrated development environment
  C. To match the software requirements to the delivery plan
  D. To project manage the software delivery
  D. To project manage the software delivery

• Question 1119:

  Secure coding can be developed by applying which one of the following?

  A. Applying the organization's acceptable use guidance
  B. Applying the industry best practice coding guidelines
  C. Applying rapid application development (RAD) coding
  D. Applying the organization's web application firewall (WAF) policy
  B. Applying the industry best practice coding guidelines

• Question 1120:

  Which of the following is a MUST for creating a new custom-built, cloud-native application designed to be horizontally scalable?

  A. Network as a Service (NaaS)
  B. Platform as a Service (PaaS)
  C. Infrastructure as a Service (IaaS)
  D. Software as a Service (SaaS)
  C. Infrastructure as a Service (IaaS)