ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 121:

  Backup information that is critical to the organization is identified through a

  A. Vulnerability Assessment (VA).
  B. Business Continuity Plan (BCP).
  C. Business Impact Analysis (BIA).
  D. data recovery analysis.
  D. data recovery analysis.

• Question 122:

  Which of the following is the final phase of the identity and access provisioning lifecycle?

  A. Recertification
  B. Revocation
  C. Removal
  D. Validation
  B. Revocation

• Question 123:

  What is the MAIN objective of risk analysis in Disaster Recovery (DR) planning?

  A. Establish Maximum Tolerable Downtime (MTD) Information Systems (IS)
  B. Define the variable cost for extended downtime scenarios
  C. Identify potential threats to business availability
  D. Establish personnel requirements for various downtime scenarios
  C. Identify potential threats to business availability

• Question 124:

  How should the retention period for an organization's social media content be defined?

  A. Based on the capacity of internal storage systems
  B. Based on legal, regulatory, and business requirements
  C. Based on the number of social media followers
  D. Based on the type of access control used for social platforms
  C. Based on the number of social media followers

• Question 125:

  HOTSPOT

  Which Web Services Security (WS-Security) specification negotiates how security tokens will be issued, renewed and validated? Click on the correct specification in the image below.

  

  

• Question 126:

  The MAIN task of promoting security for Personal Computers (PC) is:

  A. understanding the technical controls and ensuring they are correctly installed
  B. understanding the required systems and patching processes for different Operating Systems (OS)
  C. making sure that users are using only valid, authorized software, so that the chance of virus infection is reduced
  D. making users understand the risks to the machines and data, so they will take appropriate steps to protect them
  A. understanding the technical controls and ensuring they are correctly installed

• Question 127:

  Which of the following is the GREATEST risk of relying only on Capability Maturity Models (CMM) for software to guide process improvement and assess capabilities of acquired software?

  A. Organizations can only reach a maturity level 3 when using CMMs
  B. CMMs do not explicitly address safety and security
  C. CMMs can only be used for software developed in-house
  D. CMMs are vendor specific and may be biased
  B. CMMs do not explicitly address safety and security

• Question 128:

  A cloud service provider requires its customer organizations to enable maximum audit logging for its data storage service and to retain the logs for the period of three months. The audit logging generates extremely high amount of logs. What is the MOST appropriate strategy for the log retention?

  A. Keep last week's logs in an online storage and the rest in a near-line storage.
  B. Keep all logs in an online storage.
  C. Keep all logs in an offline storage.
  D. Keep last week's logs in an online storage and the rest in an offline storage.
  D. Keep last week's logs in an online storage and the rest in an offline storage.

• Question 129:

  Which of the following is the PRIMARY reason for employing physical security personnel at entry points in facilities where card access is in operation?

  A. To verify that only employees have access to the facility.
  B. To identify present hazards requiring remediation.
  C. To monitor staff movement throughout the facility.
  D. To provide a safe environment for employees.
  D. To provide a safe environment for employees.

• Question 130:

  Which of the following BEST describes when an organization should conduct a black box security audit on a new software product?

  A. When the organization wishes to check for non-functional compliance
  B. When the organization wants to enumerate known security vulnerabilities across their infrastructure
  C. When the organization has experienced a security incident
  D. When the organization is confident the final source code is complete
  B. When the organization wants to enumerate known security vulnerabilities across their infrastructure