ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1421:

  What is the purpose of code signing?

  A. The signer verifies that the software being loaded is the software originated by the signer
  B. The vendor certifies the software being loaded is free of malicious code and that it was originated by the signer
  C. The signer verifies that the software being loaded is free of malicious code
  D. Both vendor and the signer certify the software being loaded is free of malicious code and it was originated by the signer
  A. The signer verifies that the software being loaded is the software originated by the signer

• Question 1422:

  Which technique helps system designers consider potential security concerns of their systems and applications?

  A. Penetration testing
  B. Threat modeling
  C. Manual inspections and reviews
  D. Source code review
  B. Threat modeling

• Question 1423:

  An Internet software application requires authentication before a user is permitted to utilize the resource. Which testing scenario BEST validates the functionality of the application?

  A. Reasonable data testing
  B. Input validation testing
  C. Web session testing
  D. Allowed data bounds and limits testing
  B. Input validation testing

• Question 1424:

  In the Open System Interconnection (OSI) model, which layer is responsible for the transmission of binary data over a communications network?

  A. Application Layer
  B. Physical Layer
  C. Data-Link Layer
  D. Network Layer
  B. Physical Layer

• Question 1425:

  Which of the following is a credible source to validate that security testing of Commercial Off-The-Shelf (COTS) software has been performed with international standards?

  A. Common Criteria (CC)
  B. Evaluation Assurance Level (EAL)
  C. National Information Assurance Partnership (NIAP)
  D. International Standards Organization (ISO)
  A. Common Criteria (CC)

• Question 1426:

  The FIRST step in building a firewall is to

  A. assign the roles and responsibilities of the firewall administrators.
  B. define the intended audience who will read the firewall policy.
  C. identify mechanisms to encourage compliance with the policy.
  D. perform a risk analysis to identify issues to be addressed.
  D. perform a risk analysis to identify issues to be addressed.

• Question 1427:

  Which of the following is the MOST effective measure for dealing with rootkit attacks?

  A. Turing off unauthorized services and rebooting the system
  B. Finding and replacing the altered binaries with legitimate ones
  C. Restoring the system from the last backup
  D. Reinstalling the system from trusted sources
  D. Reinstalling the system from trusted sources

• Question 1428:

  A large human resources organization wants to integrate their identity management with a trusted partner organization. The human resources organization wants to maintain the creation and management of the identities and may want to share with other partners in the future. Which of the following options BEST serves their needs?

  A. Federated identity
  B. Cloud Active Directory (AD)
  C. Security Assertion Markup Language (SAML)
  D. Single sign-on (SSO)
  A. Federated identity

• Question 1429:

  Which of the following is the primary advantage of segmenting Virtual Machines (VM) using physical networks?

  A. Simplicity of network configuration and network monitoring
  B. Removes the need for decentralized management solutions
  C. Removes the need for dedicated virtual security controls
  D. Simplicity of network configuration and network redundancy
  A. Simplicity of network configuration and network monitoring

• Question 1430:

  Refer to the information below to answer the question.

  During the investigation of a security incident, it is determined that an unauthorized individual accessed a system which hosts a database containing financial information. Aside from the potential records which may have been viewed, which of the following should be the PRIMARY concern regarding the database information?

  A. Unauthorized database changes
  B. Integrity of security logs
  C. Availability of the database
  D. Confidentiality of the incident
  A. Unauthorized database changes