ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1341:

  Two companies wish to share electronic inventory and purchase orders in a supplier and client relationship. What is the BEST security solution for them?

  A. Write a Service Level Agreement (SLA) for the two companies.
  B. Set up a Virtual Private Network (VPN) between the two companies.
  C. Configure a firewall at the perimeter of each of the two companies.
  D. Establish a File Transfer Protocol (FTP) connection between the two companies.
  B. Set up a Virtual Private Network (VPN) between the two companies.

• Question 1342:

  What does the Maximum Tolerable Downtime (MTD) determine?

  A. The estimated period of time a business critical database can remain down before customers are affected.
  B. The fixed length of time a company can endure a disaster without any Disaster Recovery (DR) planning
  C. The estimated period of time a business can remain interrupted beyond which it risks never recovering
  D. The fixed length of time in a DR process before redundant systems are engaged
  C. The estimated period of time a business can remain interrupted beyond which it risks never recovering

• Question 1343:

  Which layer of the Open Systems Interconnections (OSI) model implementation adds information concerning the logical connection between the sender and receiver?

  A. Physical
  B. Session
  C. Transport
  D. Data-Link
  C. Transport

• Question 1344:

  What do Capability Maturity Models (CMM) serve as a benchmark for in an organization?

  A. Experience in the industry
  B. Definition of security profiles
  C. Human resource planning efforts
  D. Procedures in systems development
  D. Procedures in systems development

• Question 1345:

  A security analyst for a large financial institution is reviewing network traffic related to an incident. The analyst determines the traffic is irrelevant to the investigation but in the process of the review, the analyst also finds that an applications data, which included full credit card cardholder data, is transferred in clear text between the server and user's desktop. The analyst knows this violates the Payment Card Industry Data Security Standard (PCI-DSS).

  Which of the following is the analyst's next step?

  A. Send the log file co-workers for peer review
  B. Include the full network traffic logs in the incident report
  C. Follow organizational processes to alert the proper teams to address the issue.
  D. Ignore data as it is outside the scope of the investigation and the analyst's role.
  C. Follow organizational processes to alert the proper teams to address the issue.

• Question 1346:

  Which of the following is the BEST metric to obtain when gaining support for an Identify and Access Management (IAM) solution?

  A. Application connection successes resulting in data leakage
  B. Administrative costs for restoring systems after connection failure
  C. Employee system timeouts from implementing wrong limits
  D. Help desk costs required to support password reset requests
  D. Help desk costs required to support password reset requests

• Question 1347:

  Which of the following elements MUST a compliant EU-US Safe Harbor Privacy Policy contain?

  A. An explanation of how long the data subject's collected information will be retained for and how it will be eventually disposed.
  B. An explanation of who can be contacted at the organization collecting the information if corrections are required by the data subject.
  C. An explanation of the regulatory frameworks and compliance standards the information collecting organization adheres to.
  D. An explanation of all the technologies employed by the collecting organization in gathering information on the data subject.
  B. An explanation of who can be contacted at the organization collecting the information if corrections are required by the data subject.

• Question 1348:

  What BEST describes the confidentiality, integrity, availability triad?

  A. A tool used to assist in understanding how to protect the organization's data
  B. The three-step approach to determine the risk level of an organization
  C. The implementation of security systems to protect the organization's data
  D. A vulnerability assessment to see how well the organization's data is protected
  C. The implementation of security systems to protect the organization's data

• Question 1349:

  Which section of the assessment report addresses separate vulnerabilities, weaknesses, and gaps?

  A. Key findings section
  B. Executive summary with full details
  C. Risk review section
  D. Findings definition section
  A. Key findings section

• Question 1350:

  What is a security concern when considering implementing software-defined networking (SDN)?

  A. It increases the attack footprint.
  B. It uses open source protocols.
  C. It has a decentralized architecture.
  D. It is cloud based.
  C. It has a decentralized architecture.