ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1291:

  Which of the following methods protects Personally Identifiable Information (PII) by use of a full replacement of the data element?

  A. Transparent Database Encryption (TDE)
  B. Column level database encryption
  C. Volume encryption
  D. Data tokenization
  D. Data tokenization

• Question 1292:

  While reviewing a web application-to-application connection, a security professional finds the use of Representational State Transfer (REST) application programming interfaces (API) and identifies it as secure. Which one of the following connection Uniform Resource Locators (URL) applies to this scenario?

  A. https://url.com/Resources//action?apiKey=a399ikjiuynj
  B. http://url.com/SecureTLS//action
  C. http://url.com/Resources//action?apiKey=a399ikjiuynj
  D. https://url.com/Resources//action
  D. https://url.com/Resources//action

• Question 1293:

  When defining a set of security controls to mitigate a risk, which of the following actions MUST occur?

  A. Each control's effectiveness must be evaluated individually
  B. Each control must completely mitigate the risk
  C. The control set must adequately mitigate the risk
  D. The control set must evenly divide the risk
  C. The control set must adequately mitigate the risk

• Question 1294:

  Refer to the information below to answer the question.

  A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant

  messaging. The organization's Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access.

  Which of the following documents explains the proper use of the organization's assets?

  A. Human resources policy
  B. Acceptable use policy
  C. Code of ethics
  D. Access control policy
  B. Acceptable use policy

• Question 1295:

  When developing the entitlement review process, which of the following roles is responsible for determining who has a need for the information?

  A. Data Custodian
  B. Data Owner
  C. Database Administrator
  D. Information Technology (IT) Director
  B. Data Owner

• Question 1296:

  Which of the following is a PRIMARY benefit of using a formalized security testing report format and structure?

  A. Executive audiences will understand the outcomes of testing and most appropriate next steps for corrective actions to be taken
  B. Technical teams will understand the testing objectives, testing strategies applied, and business risk associated with each vulnerability
  C. Management teams will understand the testing objectives and reputational risk to the organization
  D. Technical and management teams will better understand the testing objectives, results of each test phase, and potential impact levels
  D. Technical and management teams will better understand the testing objectives, results of each test phase, and potential impact levels

• Question 1297:

  An organization has discovered that organizational data is posted by employees to data storage accessible to the general public. What is the PRIMARY step an organization must take to ensure data is properly protected from public release?

  A. Implement a data classification policy.
  B. Implement a data encryption policy.
  C. Implement a user training policy.
  D. Implement a user reporting policy.
  C. Implement a user training policy.

• Question 1298:

  If an attacker in a SYN flood attack uses someone else's valid host address as the source address, the system under attack will send a large number of Synchronize/Acknowledge (SYN/ACK) packets to the A. default gateway.

  B. attacker's address.

  C. local interface being attacked.

  D. specified source address.

  Correct Answer. D
  D

• Question 1299:

  Which of the following is the MAIN benefit of off-site storage?

  A. Cost effectiveness
  B. Backup simplicity
  C. Fast recovery
  D. Data availability
  D. Data availability

• Question 1300:

  A security professional has been requested by the Board of Directors and Chief Information Security Officer (CISO) to perform an internal and external penetration test. What is the BEST course of action?

  A. Review data localization requirements and regulations
  B. Review corporate security policies and procedures
  C. With notice to the organization, perform an internal penetration test first, then an external test
  D. With notice to the organization, perform an external penetration test first, then an internal test
  A. Review data localization requirements and regulations