ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1471:

  Which component of the Security Content Automation Protocol (SCAP) specification contains the data required to estimate the severity of vulnerabilities identified automated vulnerability assessments?

  A. Common Vulnerabilities and Exposures (CVE)
  B. Common Vulnerability Scoring System (CVSS)
  C. Asset Reporting Format (ARF)
  D. Open Vulnerability and Assessment Language (OVAL)
  B. Common Vulnerability Scoring System (CVSS)

• Question 1472:

  What is the FIRST step prior to executing a test of an organisation's disaster recovery (DR) or business continuity plan (BCP)?

  A. identify key stakeholders,
  B. Develop recommendations for disaster scenarios.
  C. Identify potential failure points.
  D. Develop clear evaluation criteria.
  D. Develop clear evaluation criteria.

• Question 1473:

  In what phase of the System Development Life Cycle (SDLC) should security training for the development team begin?

  A. Development/Acquisition
  B. Initiation
  C. Implementation/Assessment
  D. Disposal
  A. Development/Acquisition

• Question 1474:

  Which of the following documents specifies services from the client's viewpoint?

  A. Service level report
  B. Business impact analysis (BIA)
  C. Service level agreement (SLA)
  D. Service Level Requirement (SLR)
  D. Service Level Requirement (SLR)

• Question 1475:

  Which one of the following activities would present a significant security risk to organizations when employing a Virtual Private Network (VPN) solution?

  A. VPN bandwidth
  B. Simultaneous connection to other networks
  C. Users with Internet Protocol (IP) addressing conflicts
  D. Remote users with administrative rights
  B. Simultaneous connection to other networks

• Question 1476:

  Which event magnitude is defined as deadly, destructive, and disruptive when a hazard interacts with human vulnerability?

  A. Disaster
  B. Catastrophe
  C. Crisis
  D. Accident
  B. Catastrophe

• Question 1477:

  Which of the following is a characteristic of the initialization vector when using Data Encryption Standard (DES)?

  A. It must be known to both sender and receiver.
  B. It can be transmitted in the clear as a random number.
  C. It must be retained until the last block is transmitted.
  D. It can be used to encrypt and decrypt information.
  B. It can be transmitted in the clear as a random number.

• Question 1478:

  As a security manger which of the following is the MOST effective practice for providing value to an organization?

  A. Assess business risk and apply security resources accordingly
  B. Coordinate security implementations with internal audit
  C. Achieve compliance regardless of related technical issues
  D. Identify confidential information and protect it
  D. Identify confidential information and protect it

• Question 1479:

  Which of the following BEST describes a Protection Profile (PP)?

  A. A document that expresses an implementation independent set of security requirements for an IT product that meets specific consumer needs.
  B. A document that is used to develop an IT security product from its security requirements definition.
  C. A document that expresses an implementation dependent set of security requirements which contains only the security functional requirements.
  D. A document that represents evaluated products where there is a one-to-one correspondence between a PP and a Security Target (ST).
  A. A document that expresses an implementation independent set of security requirements for an IT product that meets specific consumer needs.

• Question 1480:

  Which of the following is the MOST effective way to ensure hardware and software remain updated throughout an organization?

  A. Performance of frequent security configuration audits
  B. Performance of regular vulnerability scans
  C. Use an inventory management tool
  D. Use an automated configuration monitoring system
  D. Use an automated configuration monitoring system