ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1311:

  A large corporation is looking for a solution to automate access based on where the request is coming from, who the user is, what device they are connecting with, and what and time of day they are attempting this access. What type of solution would suit their needs?

  A. Mandatory Access Control (MAC)
  B. Network Access Control (NAC)
  C. Role Based Access Control (RBAC)
  D. Discretionary Access Control (DAC)
  B. Network Access Control (NAC)

• Question 1312:

  An organization that has achieved a Capability Maturity model Integration (CMMI) level of 4 has done which of the following?

  A. Addressed continuous innovative process improvement
  B. Addressed the causes of common process variance
  C. Achieved optimized process performance
  D. Achieved predictable process performance
  C. Achieved optimized process performance

• Question 1313:

  A bank failed to meet service-level agreements (SLA) with customers after suffering from a database failure of the transaction processing system (TPS) that resulted in delayed financial deposits. A regulatory agency overseeing the bank would like to determine if the cause of the delay was a material weakness. Which of the following documents is MOST relevant for the regulatory agency to review?

  A. Business continuity plan (BCP)
  B. Business impact analysis (BIA)
  C. Continuity of Operations Plan (COOP)
  D. Enterprise resource planning (ERP)
  B. Business impact analysis (BIA)

• Question 1314:

  When planning a penetration test, the tester will be MOST interested in which information?

  A. Places to install back doors
  B. The main network access points
  C. Job application handouts and tours
  D. Exploits that can attack weaknesses
  B. The main network access points

• Question 1315:

  Which of the following is a weakness of Wired Equivalent Privacy (WEP)?

  A. Length of Initialization Vector (IV)
  B. Protection against message replay
  C. Detection of message tampering
  D. Built-in provision to rotate keys
  A. Length of Initialization Vector (IV)

• Question 1316:

  Which of the following is a correct feature of a virtual local area network (VLAN)?

  A. A VLAN segregates network traffic therefore information security is enhanced significantly.
  B. Layer 3 routing is required to allow traffic from one VLAN to another.
  C. VLAN has certain security features such as where the devices are physically connected.
  D. There is no broadcast allowed within a single VLAN due to network segregation.
  A. A VLAN segregates network traffic therefore information security is enhanced significantly.

• Question 1317:

  Which of the following System and Organization Controls (SOC) report types should an organization request if they require a period of time report covering security and availability for a particular system?

  A. SOC 1 Type1
  B. SOC 1Type2
  C. SOC 2 Type 1
  D. SOC 2 Type 2
  D. SOC 2 Type 2

• Question 1318:

  Why must all users be positively identified prior to using multi-user computers?

  A. To provide access to system privileges
  B. To provide access to the operating system
  C. To ensure that unauthorized persons cannot access the computers
  D. To ensure that management knows what users are currently logged on
  C. To ensure that unauthorized persons cannot access the computers

• Question 1319:

  Which of the following is the MOST secure protocol for remote command access to the firewall?

  A. Secure Shell (SSH)
  B. Trivial File Transfer Protocol (TFTP)
  C. Hypertext Transfer Protocol Secure (HTTPS)
  D. Simple Network Management Protocol (SNMP) v1
  A. Secure Shell (SSH)

• Question 1320:

  Which testing method requires very limited or no information about the network infrastructure?

  A. White box
  B. Static
  C. Black box
  D. Stress
  C. Black box