ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1171:

  A colleague who recently left the organization asked a security professional for a copy of the organization's confidential incident management policy. Which of the following is the BEST response to this request?

  A. Email the policy to the colleague as they were already part of the organization and familiar with it.
  B. Do not acknowledge receiving the request from the former colleague and ignore them.
  C. Access the policy on a company-issued device and let the former colleague view the screen.
  D. Submit the request using company official channels to ensure the policy is okay to distribute.
  B. Do not acknowledge receiving the request from the former colleague and ignore them.

• Question 1172:

  Which of the following would be the BEST guideline to follow when attempting to avoid the exposure of sensitive data?

  A. Store sensitive data only when necessary.
  B. Educate end-users on methods of attacks on sensitive data.
  C. Establish report parameters for sensitive data.
  D. Monitor mail servers for sensitive data being exfilltrated.
  A. Store sensitive data only when necessary.

• Question 1173:

  An organization regularly conducts its own penetration tests. Which of the following scenarios MUST be covered for the test to be effective?

  A. Third-party vendor with access to the system
  B. System administrator access compromised
  C. Internal attacker with access to the system
  D. Internal user accidentally accessing data
  B. System administrator access compromised

• Question 1174:

  At which phase of the software assurance life cycle should risks associated with software acquisition strategies be identified?

  A. Follow-on phase
  B. Planning phase
  C. Monitoring and acceptance phase
  D. Contracting phase
  C. Monitoring and acceptance phase

• Question 1175:

  When designing a networked Information System (IS) where there will be several different types of individual access, what is the FIRST step that should be taken to ensure all access control requirements are addressed?

  A. Create a user profile.
  B. Create a user access matrix.
  C. Develop an Access Control List (ACL).
  D. Develop a Role Based Access Control (RBAC) list.
  B. Create a user access matrix.

• Question 1176:

  Which of the following is an indicator that a company's new user security awareness training module has been effective?

  A. There are more secure connections to the internal database servers.
  B. More incidents of phishing attempts are being reported.
  C. There are more secure connections to internal e-mail servers.
  D. Fewer incidents of phishing attempts are being reported.
  B. More incidents of phishing attempts are being reported.

• Question 1177:

  Which of the following disaster recovery test plans will be MOST effective while providing minimal risk?

  A. Read-through
  B. Parallel
  C. Full interruption
  D. Simulation
  D. Simulation

• Question 1178:

  Which Open Systems Interconnection (OSI) layer(s) BEST corresponds to the network access layer in the Transmission Control Protocol/Internet Protocol (TCP/IP) model?

  A. Transport Layer
  B. Data Link and Physical Layers
  C. Application, Presentation, and Session Layers
  D. Session and Network Layers
  B. Data Link and Physical Layers

• Question 1179:

  Refer to the information below to answer the question.

  A security practitioner detects client-based attacks on the organization's network. A plan will be necessary to address these concerns. What is the BEST reason for the organization to pursue a plan to mitigate client-based attacks?

  A. Client privilege administration is inherently weaker than server privilege administration.
  B. Client hardening and management is easier on clients than on servers.
  C. Client-based attacks are more common and easier to exploit than server and network based attacks.
  D. Client-based attacks have higher financial impact.
  C. Client-based attacks are more common and easier to exploit than server and network based attacks.

• Question 1180:

  An organization would like to implement an authorization mechanism that would simplify the assignment of various system access permissions for many users with similar job responsibilities. Which type of authorization mechanism would be the BEST choice for the organization to implement?

  A. Role-based access control (RBAC)
  B. Discretionary access control (DAC)
  C. Content-dependent Access Control
  D. Rule-based Access Control
  A. Role-based access control (RBAC)