ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 151:

  An international trading organization that holds an International Organization for Standardization (ISO) 27001 certification is seeking to outsource their security monitoring to a managed security service provider (MSSP), The trading organization's security officer is tasked with drafting the requirements that need to be included in the outsourcing contract.

  Which of the following MUST be included in the contract?

  A. A detailed overview of all equipment involved in the outsourcing contract
  B. The MSSP having an executive manager responsible for information security
  C. The right to perform security compliance tests on the MSSP's equipment
  D. The right to audit the MSSP's security process
  C. The right to perform security compliance tests on the MSSP's equipment

• Question 152:

  Which of the following types of technologies would be the MOST cost-effective method to provide a reactive control for protecting personnel in public areas?

  A. Install mantraps at the building entrances
  B. Enclose the personnel entry area with polycarbonate plastic
  C. Supply a duress alarm for personnel exposed to the public
  D. Hire a guard to protect the public area
  C. Supply a duress alarm for personnel exposed to the public

• Question 153:

  Which of the following BEST describes how access to a system is granted to federated user accounts?

  A. With the federation assurance level
  B. Based on defined criteria by the Relying Party (RP)
  C. Based on defined criteria by the Identity Provider (IdP)
  D. With the identity assurance level
  C. Based on defined criteria by the Identity Provider (IdP)

• Question 154:

  When telephones in a city are connected by a single exchange, the caller can only connect with the switchboard operator. The operator then manually connects the call. This is an example of which type of network topology?

  A. Star
  B. Tree
  C. Point-to-Point Protocol (PPP)
  D. Bus
  A. Star

• Question 155:

  A Simple Power Analysis (SPA) attack against a device directly observes which of the following?

  A. Static discharge
  B. Consumption
  C. Generation
  D. Magnetism
  B. Consumption

• Question 156:

  Which of the following provides the MOST protection against data theft of sensitive information when a laptop is stolen?

  A. Set up a BIOS and operating system password
  B. Encrypt the virtual drive where confidential files can be stored
  C. Implement a mandatory policy in which sensitive data cannot be stored on laptops, but only on the corporate network
  D. Encrypt the entire disk and delete contents after a set number of failed access attempts
  D. Encrypt the entire disk and delete contents after a set number of failed access attempts

• Question 157:

  The PRIMARY purpose of a security awareness program is to

  A. ensure that everyone understands the organization's policies and procedures.
  B. communicate that access to information will be granted on a need-to-know basis.
  C. warn all users that access to all systems will be monitored on a daily basis.
  D. comply with regulations related to data and information protection.
  A. ensure that everyone understands the organization's policies and procedures.

• Question 158:

  What is the second phase of Public Key Infrastructure (PKI) key/certificate life-cycle management?

  A. Implementation Phase
  B. Initialization Phase
  C. Cancellation Phase
  D. Issued Phase
  D. Issued Phase

• Question 159:

  Which is the MOST critical aspect of computer-generated evidence?

  A. Objectivity
  B. Integrity
  C. Timeliness
  D. Relevancy
  B. Integrity

• Question 160:

  A vehicle of a private courier company that transports backup data for offsite storage was robbed while in transport backup data for offsite was robbed while in transit. The incident management team is now responsible to estimate the robbery, which of the following would help the incident management team to MOST effectively analyze the business impact of the robbery?

  A. Log of backup administrative actions
  B. Log of the transported media and its classification marking
  C. Log of the transported media and Its detailed contents
  D. Log of backed up data and their respective data custodians
  B. Log of the transported media and its classification marking