ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 131:

  An authentication system that uses challenge and response was recently implemented on an organization's network, because the organization conducted an annual penetration test showing that testers were able to move laterally using authenticated credentials. Which attack method was MOST likely used to achieve this?

  A. Cross-Site Scripting (XSS)
  B. Pass the ticket
  C. Brute force
  D. Hash collision
  B. Pass the ticket

• Question 132:

  Which of the fallowing statements is MOST accurate regarding information assets?

  A. International Organization for Standardization (ISO) 27001 compliance specifies which information assets must be included in asset inventory.
  B. S3 Information assets include any information that is valuable to the organization,
  C. Building an information assets register is a resource-intensive job.
  D. Information assets inventory is not required for risk assessment.
  B. S3 Information assets include any information that is valuable to the organization,

• Question 133:

  As part of an application penetration testing process, session hijacking can BEST be achieved by which of the following?

  A. Known-plaintext attack
  B. Denial of Service (DoS)
  C. Cookie manipulation
  D. Structured Query Language (SQL) injection
  C. Cookie manipulation

• Question 134:

  Which of the following is included in the Global System for Mobile Communications (GSM) security framework?

  A. Public-Key Infrastructure (PKI)
  B. Symmetric key cryptography
  C. Digital signatures
  D. Biometric authentication
  B. Symmetric key cryptography

• Question 135:

  Which of the following is the BEST reason to review audit logs periodically?

  A. Verify they are operating properly
  B. Monitor employee productivity
  C. Identify anomalies in use patterns
  D. Meet compliance regulations
  C. Identify anomalies in use patterns

• Question 136:

  Which layer handle packet fragmentation and reassembly in the Open system interconnection (OSI) Reference model?

  A. Session
  B. Transport
  C. Data Link
  D. Network
  B. Transport

• Question 137:

  Which of the following vulnerability assessment activities BEST exemplifies the Examine method of assessment?

  A. Ensuring that system audit logs capture all relevant data fields required by the security controls baseline
  B. Performing Port Scans of selected network hosts to enumerate active services
  C. Asking the Information System Security Officer (ISSO) to describe the organization's patch management processes
  D. Logging into a web server using the default administrator account and a default password
  D. Logging into a web server using the default administrator account and a default password

• Question 138:

  If an identification process using a biometric system detects a 100% match between a presented template and a stored template, what is the interpretation of this result?

  A. User error
  B. Suspected tampering
  C. Accurate identification
  D. Unsuccessful identification
  B. Suspected tampering

• Question 139:

  An Information System Security Officer (ISSO) employed by a large corporation, while also freelancing in a similar role for a competitor, violates what canon of the (ISC)2 Code of Professional Ethics?

  A. Advance and protect the profession
  B. Provide diligent and competent service to principals
  C. Act honorably, honestly, justly, responsibly, and legally
  D. Protect society, the commonwealth, and the infrastructure
  B. Provide diligent and competent service to principals

• Question 140:

  For an organization considering two-factor authentication for secure network access, which of the following is MOST secure?

  A. Challenge response and private key
  B. Digital certificates and Single Sign-On (SSO)
  C. Tokens and passphrase
  D. Smart card and biometrics
  D. Smart card and biometrics