ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1601:

  What does the result of Cost-Benefit Analysis (C8A) on new security initiatives provide?

  A. Quantifiable justification
  B. Baseline improvement
  C. Risk evaluation
  D. Formalized acceptance
  A. Quantifiable justification

• Question 1602:

  For a service provider, which of the following MOST effectively addresses confidentiality concerns for customers using cloud computing?

  A. Hash functions
  B. Data segregation
  C. File system permissions
  D. Non-repudiation controls
  B. Data segregation

• Question 1603:

  A Distributed Denial of Service (DDoS) attack was carried out using malware called Mirai to create a large-scale command and control system to launch a botnet. Which of the following devices were the PRIMARY sources used to generate the attack traffic?

  A. Internet of Things (IoT) devices
  B. Microsoft Windows hosts
  C. Web servers running open source operating systems (OS)
  D. Mobile devices running Android
  A. Internet of Things (IoT) devices

• Question 1604:

  What determines the level of security of a combination lock?

  A. Complexity of combination required to open the lock
  B. Amount of time it takes to brute force the combination
  C. The number of barrels associated with the internal mechanism
  D. The hardness score of the metal lock material
  A. Complexity of combination required to open the lock

• Question 1605:

  When designing a vulnerability test, which one of the following is likely to give the BEST indication of what components currently operate on the network?

  A. Topology diagrams
  B. Mapping tools
  C. Asset register
  D. Ping testing
  B. Mapping tools

• Question 1606:

  When a flaw in Industrial control (ICS) software is discovered, what is the GREATEST impediment to deploying a patch?

  A. Many IG systems have software that is no longer being maintained by the venders.
  B. Compensating controls may impact IG performance.
  C. Testing a patch in an IG may require more resources than the organization can commit.
  D. vendors are required to validate the operability patches.
  D. vendors are required to validate the operability patches.

• Question 1607:

  What is the BEST first step for determining if the appropriate security controls are in place for protecting data at rest?

  A. Identify regulatory requirements
  B. Conduct a risk assessment
  C. Determine business drivers
  D. Review the security baseline configuration
  B. Conduct a risk assessment

• Question 1608:

  An organization adopts a new firewall hardening standard. How can the security professional verify that the technical staff correct implemented the new standard?

  A. Perform a compliance review
  B. Perform a penetration test
  C. Train the technical staff
  D. Survey the technical staff
  B. Perform a penetration test

• Question 1609:

  Commercial off-the-shelf (COTS) software presents which of the following additional security concerns?

  A. Vendors take on the liability for COTS software vulnerabilities.
  B. In-house developed software is inherently less secure.
  C. Exploits for COTS software are well documented and publicly available.
  D. COTS software is inherently less secure.
  C. Exploits for COTS software are well documented and publicly available.

• Question 1610:

  Which of the following provides the MOST secure method for Network Access Control (NAC)?

  A. Media Access Control (MAC) filtering
  B. 802.1X authentication
  C. Application layer filtering
  D. Network Address Translation (NAT)
  B. 802.1X authentication