ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1411:

  An organization is planning a penetration test that simulates the malicious actions of a former network administrator. What kind of penetration test is needed?

  A. Functional test
  B. Unit test
  C. Grey box
  D. White box
  C. Grey box

• Question 1412:

  In the common criteria (CC) for information technology (IT) security evaluation, increasing Evaluation Assurance Levels (EAL) results in which of the following?

  A. Increased functionality
  B. Increased interoperability
  C. Increase in resource requirement
  D. Increase in evaluated systems
  B. Increased interoperability

• Question 1413:

  Which of the following is considered the last line defense in regard to a Governance, Risk managements, and compliance (GRC) program?

  A. Internal audit
  B. Internal controls
  C. Board review
  D. Risk management
  B. Internal controls

• Question 1414:

  Which of the following terms is used for online service providers operating within a federation?

  A. Active Directory Federation Services (ADFS)
  B. Relying party (RP)
  C. Single sign-on (SSO)
  D. Identity and access management (IAM)
  B. Relying party (RP)

• Question 1415:

  What is the MOST important element when considering the effectiveness of a training program for Business Continuity (BC) and Disaster Recovery (DR)?

  A. Management support
  B. Consideration of organizational need
  C. Technology used for delivery
  D. Target audience
  B. Consideration of organizational need

• Question 1416:

  When evaluating third-party applications, which of the following is the GREATEST responsibility of Information Security?

  A. Accept the risk on behalf of the organization.
  B. Report findings to the business to determine security gaps.
  C. Quantify the risk to the business for product selection.
  D. Approve the application that best meets security requirements.
  C. Quantify the risk to the business for product selection.

• Question 1417:

  What is a use for mandatory access control (MAC)?

  A. Allows for labeling of sensitive user accounts for access control
  B. Allows for mandatory user identity and passwords based on sensitivity
  C. Allows for mandatory system administrator access control over objects
  D. Allows for object security based on sensitivity represented by a label
  D. Allows for object security based on sensitivity represented by a label

• Question 1418:

  Which of the following is included in change management?

  A. Business continuity testing
  B. User Acceptance Testing (UAT) before implementation
  C. Technical review by business owner
  D. Cost-benefit analysis (CBA) after implementation
  A. Business continuity testing

• Question 1419:

  A Business Continuity Plan/Disaster Recovery Plan (BCP/DRP) will provide which of the following?

  A. Guaranteed recovery of all business functions
  B. Minimization of the need decision making during a crisis
  C. Insurance against litigation following a disaster
  D. Protection from loss of organization resources
  D. Protection from loss of organization resources

• Question 1420:

  In which of the following programs is it MOST important to include the collection of security process data?

  A. Quarterly access reviews
  B. Security continuous monitoring
  C. Business continuity testing
  D. Annual security training
  B. Security continuous monitoring