ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1321:

  Which of the following BEST describes the purpose of the reference monitor when defining access control to enforce the security model?

  A. Quality design principles to ensure quality by design
  B. Policies to validate organization rules
  C. Cyber hygiene to ensure organizations can keep systems healthy
  D. Strong operational security to keep unit members safe
  B. Policies to validate organization rules

• Question 1322:

  Which security architecture strategy could be applied to secure an operating system (OS) baseline for deployment within the corporate enterprise?

  A. Principle of Least Privilege
  B. Principle of Separation of Duty
  C. Principle of Secure Default
  D. principle of Fail Secure
  D. principle of Fail Secure

• Question 1323:

  What is the purpose of an Internet Protocol (IP) spoofing attack?

  A. To send excessive amounts of data to a process, making it unpredictable
  B. To intercept network traffic without authorization
  C. To disguise the destination address from a target's IP filtering devices
  D. To convince a system that it is communicating with a known entity
  D. To convince a system that it is communicating with a known entity

• Question 1324:

  In a change-controlled environment, which of the following is MOST likely to lead to unauthorized changes to production programs?

  A. Modifying source code without approval
  B. Promoting programs to production without approval
  C. Developers checking out source code without approval
  D. Developers using Rapid Application Development (RAD) methodologies without approval
  B. Promoting programs to production without approval

• Question 1325:

  An organization purchased a commercial off-the-shelf (COTS) software several years ago. The information technology (IT) Director has decided to migrate the application into the cloud, but is concerned about the application security of the software in the organization's dedicated environment with a cloud service provider. What is the BEST way to prevent and correct the software's security weal

  A. Implement a dedicated COTS sandbox environment
  B. Follow the software end-of-life schedule
  C. Transfer the risk to the cloud service provider
  D. Examine the software updating and patching process
  A. Implement a dedicated COTS sandbox environment

• Question 1326:

  Which of the following is the MOST important output from a mobile application threat modeling exercise according to Open Web Application Security Project (OWASP)?

  A. The likelihood and impact of a vulnerability
  B. Application interface entry and endpoints
  C. Countermeasures and mitigations for vulnerabilities
  D. A data flow diagram for the application and attack surface analysis
  D. A data flow diagram for the application and attack surface analysis

• Question 1327:

  Which of the following would MINIMIZE the ability of an attacker to exploit a buffer overflow?

  A. Memory review
  B. Code review
  C. Message division
  D. Buffer division
  B. Code review

• Question 1328:

  Why is planning the MOST critical phase of a Role Based Access Control (RBAC) implementation?

  A. The criteria for measuring risk is defined.
  B. User populations to be assigned to each role is determined.
  C. Role mining to define common access patterns is performed.
  D. The foundational criteria are defined.
  B. User populations to be assigned to each role is determined.

• Question 1329:

  Multi-Factor Authentication (MFA) is necessary in many systems given common types of password attacks. Which of the following is a correct list of password attacks?

  A. Masquerading, salami, malware, polymorphism
  B. Brute force, dictionary, phishing, keylogger
  C. Zeus, netbus, rabbit, turtle
  D. Token, biometrics, IDS, DLP
  B. Brute force, dictionary, phishing, keylogger

• Question 1330:

  What does secure authentication with logging provide?

  A. Data integrity
  B. Access accountability
  C. Encryption logging format
  D. Segregation of duties
  B. Access accountability