ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1441:

  DRAG DROP

  Match the access control type to the example of the control type. Drag each access control type net to its corresponding example.

  Select and Place:

  

  

• Question 1442:

  How can an attacker exploit overflow to execute arbitrary code?

  A. Modify a function's return address.
  B. Alter the address of the stack.
  C. Substitute elements in the stack.
  D. Move the stack pointer.
  A. Modify a function's return address.

• Question 1443:

  Which of the following could be considered the MOST significant security challenge when adopting DevOps practices compared to a more traditional control framework?

  A. Achieving Service Level Agreements (SLA) on how quickly patches will be released when a security flaw is found.
  B. Maintaining segregation of duties.
  C. Standardized configurations for logging, alerting, and security metrics.
  D. Availability of security teams at the end of design process to perform last-minute manual audits and reviews.
  B. Maintaining segregation of duties.

• Question 1444:

  Which of the following is the MOST appropriate action when reusing media that contains sensitive data?

  A. Erase
  B. Sanitize
  C. Encrypt
  D. Degauss
  B. Sanitize

• Question 1445:

  DRAG DROP

  Match the level of evaluation to the correct common criteria (CC) assurance level. Drag each level of evaluation on the left to is corresponding CC assurance level on the right

  Select and Place:

  

  

• Question 1446:

  Which of the following is a common measure within a Local Area Network (LAN) to provide en additional level of security through segmentation?

  A. Building Virtual Local Area Networks (VLAN)
  B. Building Demilitarized Zones (DMZ)
  C. Implementing a virus scanner
  D. Implementing an Intrusion Detection System (IDS)
  A. Building Virtual Local Area Networks (VLAN)

• Question 1447:

  Which of the following is the BEST method to validate secure coding techniques against injection and overflow attacks?

  A. Scheduled team review of coding style and techniques for vulnerability patterns
  B. Using automated programs to test for the latest known vulnerability patterns
  C. The regular use of production code routines from similar applications already in use
  D. Ensure code editing tools are updated against known vulnerability patterns
  B. Using automated programs to test for the latest known vulnerability patterns

• Question 1448:

  Which of the following BEST describes the purpose of software forensics?

  A. To perform cyclic redundancy check (CRC) verification and detect changed applications
  B. To review program code to determine the existence of backdoors
  C. To analyze possible malicious intent of malware
  D. To determine the author and behavior of the code
  D. To determine the author and behavior of the code

• Question 1449:

  An organization is implementing data encryption using symmetric ciphers and the Chief Information Officer (CIO) is concerned about the risk of using one key to protect all sensitive data. The security practitioner has been tasked with recommending a solution to address the CIO's concerns. Which of the following is the BEST approach to achieving the objective by encrypting all sensitive data?

  A. Use a Secure Hash Algorithm 256 (SHA-256).
  B. Use Rivest-Shamir-Adleman (RSA) keys.
  C. Use a hierarchy of encryption keys.
  D. Use Hash Message Authentication Code (HMAC) keys.
  B. Use Rivest-Shamir-Adleman (RSA) keys.

• Question 1450:

  When assessing the audit capability of an application, which of the following activities is MOST important?

  A. Determine if audit records contain sufficient information.
  B. Review security plan for actions to be taken in the event of audit failure.
  C. Verify if sufficient storage is allocated for audit records.
  D. Identify procedures to investigate suspicious activity.
  C. Verify if sufficient storage is allocated for audit records.