ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1301:

  A security engineer is tasked with implementing a new identity solution. The client doesn't want to install or maintain the infrastructure. Which of the following would qualify as the BEST solution?

  A. Microsoft Identity Manager (MIM)
  B. Azure Active Directory (AD)
  C. Active Directory Federation Services (ADFS)
  D. Active Directory (AD)
  B. Azure Active Directory (AD)

• Question 1302:

  What is the expected outcome of security awareness in support of a security awareness program?

  A. Awareness activities should be used to focus on security concerns and respond to those concerns accordingly
  B. Awareness is not an activity or part of the training but rather a state of persistence to support the program
  C. Awareness is training. The purpose of awareness presentations is to broaden attention of security.
  D. Awareness is not training. The purpose of awareness presentation is simply to focus attention on security.
  D. Awareness is not training. The purpose of awareness presentation is simply to focus attention on security.

• Question 1303:

  Which of the following techniques is known to be effective in spotting resource exhaustion problems, especially with resources such as processes, memory, and connections?

  A. Automated dynamic analysis
  B. Automated static analysis
  C. Manual code review
  D. Fuzzing
  A. Automated dynamic analysis

• Question 1304:

  Although code using a specific program language may not be susceptible to a buffer overflow attack, A. most calls to plug-in programs are susceptible.

  B. most supporting application code is susceptible.

  C. the graphical images used by the application could be susceptible.

  D. the supporting virtual machine could be susceptible.

  Correct Answer. C
  C

• Question 1305:

  What technique used for spoofing the origin of an email can successfully conceal the sender s Internet Protocol (IP) address?

  A. Change In-Reply-To data
  B. Web crawling
  C. Onion routing
  D. Virtual Private Network (VPN)
  C. Onion routing

• Question 1306:

  Which of the following is the BEST defense against password guessing?

  A. Limit external connections to the network
  B. Disable the account after a limited number of unsuccessful attempts
  C. Force the password to be changed after an invalid password has been entered
  D. Require a combination of letters, numbers, and special characters in the password
  B. Disable the account after a limited number of unsuccessful attempts

• Question 1307:

  While impersonating an Information Security Officer (ISO), an attacker obtains information from company employees about their User IDs and passwords. Which method of information gathering has the attacker used?

  A. Trusted path
  B. Malicious logic
  C. Social engineering
  D. Passive misuse
  C. Social engineering

• Question 1308:

  Intellectual property rights are PRIMARY concerned with which of the following?

  A. Owner's ability to realize financial gain
  B. Owner's ability to maintain copyright
  C. Right of the owner to enjoy their creation
  D. Right of the owner to control delivery method
  A. Owner's ability to realize financial gain

• Question 1309:

  A security professional is assessing the risk in an application and does not take into account any mitigating or compensating controls. This type of risk rating is an example of which of the following?

  A. Transferred risk
  B. Inherent risk
  C. Residual risk
  D. Avoided risk
  C. Residual risk

• Question 1310:

  Attack trees are MOST useful for which of the following?

  A. Determining system security scopes
  B. Generating attack libraries
  C. Enumerating threats
  D. Evaluating Denial of Service (DoS) attacks
  A. Determining system security scopes