ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1401:

  An application team is running tests to ensure that user entry fields will not accept invalid input of any length. What type of negative testing is this an example of?

  A. Reasonable data
  B. Population of required fields
  C. Allowed number of characters
  D. Session testing
  C. Allowed number of characters

• Question 1402:

  Which of the following statements is TRUE about Secure Shell (SSH)?

  A. SSH does not protect against man-in-the-middle (MITM) attacks.
  B. SSH supports port forwarding, which can be used to protect less secured protocols.
  C. SSH can be used with almost any application because it is concerned with maintaining a circuit.
  D. SSH is easy to deploy because it requires a Web browser only.
  B. SSH supports port forwarding, which can be used to protect less secured protocols.

• Question 1403:

  What is the MOST significant benefit of role-based access control (RBAC)?

  A. Reduction in authorization administration overhead
  B. Reduces inappropriate access
  C. Management of least privilege
  D. Most granular form of access control
  A. Reduction in authorization administration overhead

• Question 1404:

  A customer continues to experience attacks on their email, web, and File Transfer Protocol (FTP) servers. These attacks are impacting their business operations. Which of the following is the BEST recommendation to make?

  A. Configure an intrusion detection system (IDS).
  B. Create a demilitarized zone (DMZ).
  C. Deploy a bastion host.
  D. Setup a network firewall.
  C. Deploy a bastion host.

• Question 1405:

  Which of the following is held accountable for the risk to organizational systems and data that result from outsourcing Information Technology (IT) systems and services?

  A. The acquiring organization
  B. The service provider
  C. The risk executive (function)
  D. The IT manager
  C. The risk executive (function)

• Question 1406:

  The client of a security firm reviewed a vulnerability assessment report and claims the report is inaccurate. The client states that the vulnerabilities listed are not valid because the host’s operating system (OS) was not properly detected. Where in the vulnerability assessment process did the error MOST likely occur?

  A. Report writing
  B. Detection
  C. Enumeration
  D. Scanning
  D. Scanning

• Question 1407:

  Which of the following is a document that identifies each item seized in an investigation, including date and time seized, full name and signature or initials of the person who seized the item, and a detailed description of the item?

  A. Property book
  B. Chain of custody form
  C. Search warrant return
  D. Evidence tag
  B. Chain of custody form

• Question 1408:

  Which one of the following BEST protects vendor accounts that are used for emergency maintenance?

  A. Encryption of routing tables
  B. Vendor access should be disabled until needed
  C. Role-based access control (RBAC)
  D. Frequent monitoring of vendor access
  B. Vendor access should be disabled until needed

• Question 1409:

  During a fingerprint verification process, which of the following is used to verify identity and authentication?

  A. A pressure value is compared with a stored template
  B. Sets of digits are matched with stored values
  C. A hash table is matched to a database of stored value
  D. A template of minutiae is compared with a stored template
  D. A template of minutiae is compared with a stored template

• Question 1410:

  A federal agency has hired an auditor to perform penetration testing on a critical system as part of the mandatory, annual Federal Information Security Management Act (FISMA) security assessments. The auditor is new to this system but has extensive experience with all types of penetration testing. The auditor has decided to begin with sniffing network traffic. What type of penetration testing is the auditor conducting?

  A. White box testing
  B. Black box testing
  C. Gray box testing
  D. Red box testing
  C. Gray box testing