ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1131:

  Additional padding may be added to toe Encapsulating Security Protocol (ESP) b trailer to provide which of the following?

  A. Access control
  B. Partial traffic flow confidentiality
  C. Protection against replay attack
  D. Data origin authentication
  C. Protection against replay attack

• Question 1132:

  When reviewing the security logs, the password shown for an administrative login event was ' OR ' '1'='1' --. This is an example of which of the following kinds of attack?

  A. Brute Force Attack
  B. Structured Query Language (SQL) Injection
  C. Cross-Site Scripting (XSS)
  D. Rainbow Table Attack
  B. Structured Query Language (SQL) Injection

• Question 1133:

  Where can the Open Web Application Security Project (OWASP) list of associated vulnerabilities be found?

  A. OWASP Top 10 Project
  B. OWASP Software Assurance Maturity Model (SAMM) Project
  C. OWASP Guide Project
  D. OWASP Mobile Project
  A. OWASP Top 10 Project

• Question 1134:

  Which of the following is the BEST way to protect an organization's data assets?

  A. Monitor and enforce adherence to security policies.
  B. Encrypt data in transit and at rest using up-to-date cryptographic algorithms.
  C. Create the Demilitarized Zone (DMZ) with proxies, firewalls and hardened bastion hosts.
  D. Require Multi-Factor Authentication (MFA) and Separation of Duties (SoD).
  B. Encrypt data in transit and at rest using up-to-date cryptographic algorithms.

• Question 1135:

  Which of the following is a physical security control that protects Automated Teller Machines (ATM) from skimming?

  A. Anti-tampering
  B. Secure card reader
  C. Radio Frequency (RF) scanner
  D. Intrusion Prevention System (IPS)
  A. Anti-tampering

• Question 1136:

  What is the PRIMARY reason for implementing change management?

  A. Certify and approve releases to the environment
  B. Provide version rollbacks for system changes
  C. Ensure that all applications are approved
  D. Ensure accountability for changes to the environment
  D. Ensure accountability for changes to the environment

• Question 1137:

  When assessing an organization's security policy according to standards established by the International Organization for Standardization (ISO) 27001 and 27002, when can management responsibilities be defined?

  A. Only when assets are clearly defined
  B. Only when standards are defined
  C. Only when controls are put in place
  D. Only procedures are defined
  A. Only when assets are clearly defined

• Question 1138:

  Which of the following goals represents a modern shift in risk management according to National Institute of Standards and Technology (NIST)?

  A. Focus on operating environments that are changing, evolving, and full of emerging threats.
  B. Secure information technology (IT) systems that store, process, or transmit organizational information.
  C. Enable management to make well-informed risk-based decisions justifying security expenditure.
  D. Provide an improved mission accomplishment approach.
  C. Enable management to make well-informed risk-based decisions justifying security expenditure.

• Question 1139:

  Clothing retailer employees are provisioned with user accounts that provide access to resources at partner businesses. All partner businesses use common identity and access management (IAM) protocols and differing technologies. Under the Extended Identity principle, what is the process flow between partner businesses to allow this TAM action?

  A. Clothing retailer acts as identity provider (IdP), confirms identity of user using industry standards, then sends credentials to partner businesses that act as a Service Provider and allows access to services.
  B. Clothing retailer acts as User Self Service, confirms identity of user using industry standards, then sends credentials to partner businesses that act as a Service Provider and allows access to services.
  C. Clothing retailer acts as Service Provider, confirms identity of user using industry standards, then sends credentials to partner businesses that act as an identity provider (IdP) and allows access to resources.
  D. Clothing retailer acts as Access Control Provider, confirms access of user using industry standards, then sends credentials to partner businesses that act as a Service Provider and allows access to resources.
  A. Clothing retailer acts as identity provider (IdP), confirms identity of user using industry standards, then sends credentials to partner businesses that act as a Service Provider and allows access to services.

• Question 1140:

  Which of the following is the MAIN reason that system re-certification and re-accreditation are needed?

  A. To assist data owners in making future sensitivity and criticality determinations
  B. To assure the software development team that all security issues have been addressed
  C. To verify that security protection remains acceptable to the organizational security policy
  D. To help the security team accept or reject new systems for implementation and production
  C. To verify that security protection remains acceptable to the organizational security policy