ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1381:

  Which of the following methods is MOST effective in mitigating Cross-Site Scripting (XSS) vulnerabilities within HyperText Markup Language (HTML) websites?

  A. Use antivirus and endpoint protection on the server to secure the web-based application
  B. Place the web-based system in a defined Demilitarized Zone (DMZ)
  C. Use .NET framework with .aspx extension to provide a higher level of security to the web application so that the web server display can be locked down
  D. Not returning any HTML tags to the browser client
  D. Not returning any HTML tags to the browser client

• Question 1382:

  A small office is running WiFi 4 APs, and neighboring offices do not want to increase the throughput to associated devices. Which of the following is the MOST cost-efficient way for the office to increase network performance?

  A. Add another AP.
  B. Disable the 2.4GHz radios
  C. Enable channel bonding.
  D. Upgrade to WiFi 5.
  C. Enable channel bonding.

• Question 1383:

  Network-based logging has which advantage over host-based logging when reviewing malicious activity about a victim machine?

  A. Addresses and protocols of network-based logs are analyzed.
  B. Host-based system logging has files stored in multiple locations.
  C. Properly handled network-based logs may be more reliable and valid.
  D. Network-based systems cannot capture users logging into the console.
  A. Addresses and protocols of network-based logs are analyzed.

• Question 1384:

  Which of the following attacks, if successful, could give an intruder complete control of a software-defined networking (SDN) architecture?

  A. Sniffing the traffic of a compromised host inside the network
  B. Sending control messages to open a flow that does not pass a firewall from a compromised host within the network
  C. A brute force password attack on the Secure Shell (SSH) port of the controller
  D. Remote Authentication Dial-In User Service (RADIUS) token replay attack
  B. Sending control messages to open a flow that does not pass a firewall from a compromised host within the network

• Question 1385:

  Which of the following threats would be MOST likely mitigated by monitoring assets containing open source libraries for vulnerabilities?

  A. Distributed denial-of-service (DDoS) attack
  B. Zero-day attack
  C. Phishing attempt
  D. Advanced persistent threat (APT) attempt
  A. Distributed denial-of-service (DDoS) attack

• Question 1386:

  Which of the following Disaster recovery (DR) testing processes is LEAST likely to disrupt normal business operations?

  A. Parallel
  B. Simulation
  C. Table-top
  D. Cut-over
  C. Table-top

• Question 1387:

  A healthcare insurance organization chose a vendor to develop a software application. Upon review of the draft contract, the information security professional notices that software security is not addressed. What is the BEST approach to address the issue?

  A. Update the service level agreement (SLA) to provide the organization the right to audit the vendor.
  B. Update the service level agreement (SLA) to require the vendor to provide security capabilities.
  C. Update the contract so that the vendor is obligated to provide security capabilities.
  D. Update the contract to require the vendor to perform security code reviews.
  C. Update the contract so that the vendor is obligated to provide security capabilities.

• Question 1388:

  Which of the following value comparisons MOST accurately reflects the agile development approach?

  A. Processes and tools over individuals and interactions
  B. Contract negotiation over customer collaboration
  C. Following a plan over responding to change
  D. Working software over comprehensive documentation
  D. Working software over comprehensive documentation

• Question 1389:

  The threat modeling identifies a man-in-the-middle (MITM) exposure. Which countermeasure should the information system security officer (ISSO) select to mitigate the risk of a protected Health information (PHI) data leak?

  A. Auditing
  B. Anonymization
  C. Privacy monitoring
  D. Data retention
  B. Anonymization

• Question 1390:

  Who should formulate conclusions from a particular digital fore Ball, Submit a Toper Of Tags, and the results?

  A. The information security professional's supervisor
  B. Legal counsel for the information security professional's employer
  C. The information security professional who conducted the analysis
  D. A peer reviewer of the information security professional
  B. Legal counsel for the information security professional's employer