ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1611:

  When determining who can accept the risk associated with a vulnerability, which of the following is MOST important?

  A. Countermeasure effectiveness
  B. Type of potential loss
  C. Incident likelihood
  D. Information ownership
  D. Information ownership

• Question 1612:

  A software development company has a short timeline in which to deliver a software product. The software development team decides to use open-source software libraries to reduce the development time. What concept should software developers consider when using open-source software libraries?

  A. Open source libraries contain known vulnerabilities, and adversaries regularly exploit those vulnerabilities in the wild.
  B. Open source libraries can be used by everyone, and there is a common understanding that the vulnerabilities in these libraries will not be exploited.
  C. Open source libraries are constantly updated, making it unlikely that a vulnerability exists for an adversary to exploit.
  D. Open source libraries contain unknown vulnerabilities, so they should not be used.
  A. Open source libraries contain known vulnerabilities, and adversaries regularly exploit those vulnerabilities in the wild.

• Question 1613:

  A system has been scanned for vulnerabilities and has been found to contain a number of communication ports that have been opened without authority. To which of the following might this system have been subjected?

  A. Trojan horse
  B. Denial of Service (DoS)
  C. Spoofing
  D. Man-in-the-Middle (MITM)
  A. Trojan horse

• Question 1614:

  What is a common challenge when implementing Security Assertion Markup Language (SAML) for identity integration between on-premise environment and an external identity provider service?

  A. Some users are not provisioned into the service.
  B. SAML tokens are provided by the on-premise identity provider.
  C. Single users cannot be revoked from the service.
  D. SAML tokens contain user information.
  A. Some users are not provisioned into the service.

• Question 1615:

  A systems engineer is designing a wide area network (WAN) environment for a new organization. The WAN will connect sites holding information at various levels of sensitivity, from publicly available to highly confidential. The organization requires a high degree of interconnectedness to support existing business processes. What is the BEST design approach to securing this environment?

  A. Place firewalls around critical devices, isolating them from the rest of the environment.
  B. Layer multiple detective and preventative technologies at the environment perimeter.
  C. Use reverse proxies to create a secondary "shadow" environment for critical systems.
  D. Align risk across all interconnected elements to ensure critical threats are detected and handled.
  B. Layer multiple detective and preventative technologies at the environment perimeter.

• Question 1616:

  Internet protocol security (IPSec), point-to-point tunneling protocol (PPTP), and secure sockets Layer (SSL) all use Which of the following to prevent replay attacks?

  A. Large Key encryption
  B. Single integrity protection
  C. Embedded sequence numbers
  D. Randomly generated nonces
  C. Embedded sequence numbers

• Question 1617:

  A company whose Information Technology (IT) services are being delivered from a Tier 4 data center, is preparing a companywide Business Continuity Planning (BCP). Which of the following failures should the IT manager be concerned with?

  A. Application
  B. Storage
  C. Power
  D. Network
  A. Application

• Question 1618:

  What should be the FIRST action for a security administrator who detects an intrusion on the network based on precursors and other indicators?

  A. Isolate and contain the intrusion.
  B. Notify system and application owners.
  C. Apply patches to the Operating Systems (OS).
  D. Document and verify the intrusion.
  D. Document and verify the intrusion.

• Question 1619:

  Why is data classification control important to an organization?

  A. To ensure its integrity, confidentiality and availability
  B. To enable data discovery
  C. To control data retention in alignment with organizational policies and regulation
  D. To ensure security controls align with organizational risk appetite
  A. To ensure its integrity, confidentiality and availability

• Question 1620:

  An IT technician suspects a break in one of the uplinks that provides connectivity to the core switch. Which of the following command-line tools should the technician use to determine where the incident is occurring?

  A. nslookup
  B. show config
  C. netstat
  D. show interface
  E. show counters
  D. show interface